Set allowRemoteModules=false can not prevent load remote npm packages with "npm:" specifier

[Code2Life]

Bug report

• [ √] I confirm this is a bug with Supabase, not with my own application.
• [ √] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

allowRemoteModules=false doesn't work when using npm: specifier

To Reproduce

1. Create main worker like this:

await EdgeRuntime.userWorkers.create({
      servicePath,
      memoryLimitMb,
      workerTimeoutMs,
      noModuleCache,

      allowRemoteModules: false,
      ...
    });

2. In user worker, define import

import * as jose from 'npm:jose'

Expected behavior

It should result in
worker boot error failed to load 'npm:something', A remote specifier was requested, but --no-remote is specified.

BUT, it import remote module successfully, while https:// or jsr: prefix works and result in "--no-remote is specified" error

Screenshots

npm specifier still loaded from remote

while jsr specifier can result in expected error:

[github-actions]

🎉 This issue has been resolved in version 1.50.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[Code2Life]

wow, so fast