BREAKING: remove support for remote import maps in deno.json (#25836)

This is for security reasons for the time being for Deno 2. Details to
follow post Deno 2.0 release.

Remote import maps seem incredibly rare (only 2 usages on GitHub from
what I can tell), so we'll add this back with more permissions if
there's enough demand for it:
https://github.com/search?type=code&q=%2F%22importMap%22%3A+%22http%2F

In the meantime, use the `--import-map` flag and `"deno.importMap"`
config in the LSP for remote import maps.

Cargo.lock

@@ -1375,9 +1375,9 @@ dependencies = [
 
 [[package]]
 name = "deno_config"
-version = "0.34.3"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "187d7dd888a49bfda396632371139e940c5cf47b15bfcaeeb2ba50f82f6940ec"
+checksum = "105864a9e0a7fbc22f1106784b2d263f402f157be1c3e1a9905f53d182700c9f"
 dependencies = [
  "anyhow",
  "deno_package_json",

cli/Cargo.toml

@@ -65,7 +65,7 @@ winres.workspace = true
 [dependencies]
 deno_ast = { workspace = true, features = ["bundler", "cjs", "codegen", "proposal", "react", "sourcemap", "transforms", "typescript", "view", "visit"] }
 deno_cache_dir = { workspace = true }
-deno_config = { version = "=0.34.3", features = ["workspace", "sync"] }
+deno_config = { version = "=0.35.0", features = ["workspace", "sync"] }
 deno_core = { workspace = true, features = ["include_js_files_for_snapshotting"] }
 deno_doc = { version = "0.148.0", features = ["html", "syntect"] }
 deno_graph = { version = "=0.82.1" }

cli/args/mod.rs

@@ -1065,27 +1065,13 @@ impl CliOptions {
         None => None,
       }
     };
-    Ok(
+    Ok(self.workspace().create_resolver(
-      self
-        .workspace()
-        .create_resolver(
       CreateResolverOptions {
         pkg_json_dep_resolution,
         specified_import_map: cli_arg_specified_import_map,
       },
-          |specifier| {
+      |path| Ok(std::fs::read_to_string(path)?),
-            let specifier = specifier.clone();
+    )?)
-            async move {
-              let file = file_fetcher
-                .fetch_bypass_permissions(&specifier)
-                .await?
-                .into_text_decoded()?;
-              Ok(file.source.to_string())
-            }
-          },
-        )
-        .await?,
-    )
   }
 
   pub fn node_ipc_fd(&self) -> Option<i64> {

cli/lsp/config.rs

@@ -1451,9 +1451,10 @@ impl ConfigData {
     // Mark the import map as a watched file
     if let Some(import_map_specifier) = member_dir
       .workspace
-      .to_import_map_specifier()
+      .to_import_map_path()
       .ok()
       .flatten()
+      .and_then(|path| Url::from_file_path(path).ok())
     {
       add_watched_file(
         import_map_specifier.clone(),
@@ -1542,29 +1543,15 @@ impl ConfigData {
         None
       }
     };
-    let resolver = deno_core::unsync::spawn({
+    let resolver = member_dir
-      let workspace = member_dir.workspace.clone();
+      .workspace
-      let file_fetcher = file_fetcher.cloned();
-      async move {
-        workspace
       .create_resolver(
         CreateResolverOptions {
           pkg_json_dep_resolution,
           specified_import_map,
         },
-            move |specifier| {
+        |path| Ok(std::fs::read_to_string(path)?),
-              let specifier = specifier.clone();
-              let file_fetcher = file_fetcher.clone().unwrap();
-              async move {
-                let file = file_fetcher
-                  .fetch_bypass_permissions(&specifier)
-                  .await?
-                  .into_text_decoded()?;
-                Ok(file.source.to_string())
-              }
-            },
       )
-          .await
       .inspect_err(|err| {
         lsp_warn!(
           "  Failed to load resolver: {}",
@@ -1572,10 +1559,6 @@ impl ConfigData {
         );
       })
       .ok()
-      }
-    })
-    .await
-    .unwrap()
       .unwrap_or_else(|| {
         // create a dummy resolver
         WorkspaceResolver::new_raw(

tests/integration/lsp_tests.rs

@@ -363,13 +363,6 @@ fn lsp_import_map_remote() {
     .use_temp_cwd()
     .build();
   let temp_dir = context.temp_dir();
-  temp_dir.write(
-    "deno.json",
-    json!({
-      "importMap": "http://localhost:4545/import_maps/import_map_remote.json",
-    })
-    .to_string(),
-  );
   temp_dir.write(
     "file.ts",
     r#"