BREAKING: remove support for remote import maps in deno.json (#25836)

This is for security reasons for the time being for Deno 2. Details to
follow post Deno 2.0 release.

Remote import maps seem incredibly rare (only 2 usages on GitHub from
what I can tell), so we'll add this back with more permissions if
there's enough demand for it:
https://github.com/search?type=code&q=%2F%22importMap%22%3A+%22http%2F

In the meantime, use the `--import-map` flag and `"deno.importMap"`
config in the LSP for remote import maps.

Cargo.lock

@@ -1375,9 +1375,9 @@ dependencies = [
 
 [[package]]
 name = "deno_config"
-version = "0.34.3"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "187d7dd888a49bfda396632371139e940c5cf47b15bfcaeeb2ba50f82f6940ec"
+checksum = "105864a9e0a7fbc22f1106784b2d263f402f157be1c3e1a9905f53d182700c9f"
 dependencies = [
  "anyhow",
  "deno_package_json",

cli/Cargo.toml

@@ -65,7 +65,7 @@ winres.workspace = true
 [dependencies]
 deno_ast = { workspace = true, features = ["bundler", "cjs", "codegen", "proposal", "react", "sourcemap", "transforms", "typescript", "view", "visit"] }
 deno_cache_dir = { workspace = true }
-deno_config = { version = "=0.34.3", features = ["workspace", "sync"] }
+deno_config = { version = "=0.35.0", features = ["workspace", "sync"] }
 deno_core = { workspace = true, features = ["include_js_files_for_snapshotting"] }
 deno_doc = { version = "0.148.0", features = ["html", "syntect"] }
 deno_graph = { version = "=0.82.1" }

cli/args/mod.rs

@@ -1065,27 +1065,13 @@ impl CliOptions {
         None => None,
       }
     };
-    Ok(
-      self
-        .workspace()
-        .create_resolver(
-          CreateResolverOptions {
-            pkg_json_dep_resolution,
-            specified_import_map: cli_arg_specified_import_map,
-          },
-          |specifier| {
-            let specifier = specifier.clone();
-            async move {
-              let file = file_fetcher
-                .fetch_bypass_permissions(&specifier)
-                .await?
-                .into_text_decoded()?;
-              Ok(file.source.to_string())
-            }
-          },
-        )
-        .await?,
-    )
+    Ok(self.workspace().create_resolver(
+      CreateResolverOptions {
+        pkg_json_dep_resolution,
+        specified_import_map: cli_arg_specified_import_map,
+      },
+      |path| Ok(std::fs::read_to_string(path)?),
+    )?)
   }
 
   pub fn node_ipc_fd(&self) -> Option<i64> {

cli/lsp/config.rs

@@ -1451,9 +1451,10 @@ impl ConfigData {
     // Mark the import map as a watched file
     if let Some(import_map_specifier) = member_dir
       .workspace
-      .to_import_map_specifier()
+      .to_import_map_path()
       .ok()
       .flatten()
+      .and_then(|path| Url::from_file_path(path).ok())
     {
       add_watched_file(
         import_map_specifier.clone(),
@@ -1542,50 +1543,32 @@ impl ConfigData {
         None
       }
     };
-    let resolver = deno_core::unsync::spawn({
-      let workspace = member_dir.workspace.clone();
-      let file_fetcher = file_fetcher.cloned();
-      async move {
-        workspace
-          .create_resolver(
-            CreateResolverOptions {
-              pkg_json_dep_resolution,
-              specified_import_map,
-            },
-            move |specifier| {
-              let specifier = specifier.clone();
-              let file_fetcher = file_fetcher.clone().unwrap();
-              async move {
-                let file = file_fetcher
-                  .fetch_bypass_permissions(&specifier)
-                  .await?
-                  .into_text_decoded()?;
-                Ok(file.source.to_string())
-              }
-            },
-          )
-          .await
-          .inspect_err(|err| {
-            lsp_warn!(
-              "  Failed to load resolver: {}",
-              err // will contain the specifier
-            );
-          })
-          .ok()
-      }
-    })
-    .await
-    .unwrap()
-    .unwrap_or_else(|| {
-      // create a dummy resolver
-      WorkspaceResolver::new_raw(
-        scope.clone(),
-        None,
-        member_dir.workspace.resolver_jsr_pkgs().collect(),
-        member_dir.workspace.package_jsons().cloned().collect(),
-        pkg_json_dep_resolution,
+    let resolver = member_dir
+      .workspace
+      .create_resolver(
+        CreateResolverOptions {
+          pkg_json_dep_resolution,
+          specified_import_map,
+        },
+        |path| Ok(std::fs::read_to_string(path)?),
       )
-    });
+      .inspect_err(|err| {
+        lsp_warn!(
+          "  Failed to load resolver: {}",
+          err // will contain the specifier
+        );
+      })
+      .ok()
+      .unwrap_or_else(|| {
+        // create a dummy resolver
+        WorkspaceResolver::new_raw(
+          scope.clone(),
+          None,
+          member_dir.workspace.resolver_jsr_pkgs().collect(),
+          member_dir.workspace.package_jsons().cloned().collect(),
+          pkg_json_dep_resolution,
+        )
+      });
     if !resolver.diagnostics().is_empty() {
       lsp_warn!(
         "  Import map diagnostics:\n{}",

tests/integration/lsp_tests.rs

@@ -363,13 +363,6 @@ fn lsp_import_map_remote() {
     .use_temp_cwd()
     .build();
   let temp_dir = context.temp_dir();
-  temp_dir.write(
-    "deno.json",
-    json!({
-      "importMap": "http://localhost:4545/import_maps/import_map_remote.json",
-    })
-    .to_string(),
-  );
   temp_dir.write(
     "file.ts",
     r#"