Skip to content

feat(pm): support ‎http(s): specifiers and aliases for ‎deno add #29737

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

kingsword09
Copy link

This PR implements two related features for the ‎deno add command as described in #23216  and #23144 :

  • Adds support for ‎http: and ‎https: specifiers, allowing users to do
    deno add path@https://deno.land/std/path/mod.ts fs@https://deno.land/std/fs/mod.ts

@CLAassistant
Copy link

CLAassistant commented Jun 13, 2025

CLA assistant check
All committers have signed the CLA.

@Hajime-san
Copy link
Contributor

Could we trust connecting to a registry without TLS except for localhost?

@anonhostpi
Copy link

Could we trust connecting to a registry without TLS except for localhost?

Yes and no. In some applications, TLS adds unnecessary overhead in environments that don't require secure comm (isolated networks are a common example).

It should be up to the end user to decide if they want to make themselves vulnerable to MitM attacks.

What I would recommend is warning the user that the usage of http makes them susceptible to malicious code injection via MitM

@kingsword09 kingsword09 force-pushed the feat-add-packages-via-http-urls branch from 383c10d to bf324e3 Compare June 17, 2025 01:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants