Deno 2.0: esbuild deno-loader refuses to import from unpkg due to lack of --allow-import flag

[lionel-rowe]

Related: denoland/deno - feat: add --allow-import flag
Similar (but probably not related): #2696

In Deno 2.0.0, esbuild deno-loader refuses to import from unpkg due to lack of --allow-import flag when an unpkg library is imported inside an island.

I'm not sure if this is a bug in Deno, esbuild deno-loader, or Fresh itself.

Repro:

1. Bootstrap app with deno run -A -r https://fresh.deno.dev

2. Replace content of islands/Counter.tsx with the following:

   import * as mod from 'https://unpkg.com/[email protected]/esm/standalone.mjs'
   
   console.log(mod && 'ok')
   
   export default function() {
     return <div>...</div>
   }

3. Run deno task build and observe error in CLI console:

   ✘ [ERROR] Requires import access to "unpkg.com:443", run again with the --allow-import flag [plugin deno-loader]
   
       islands/Counter.tsx:2:21:
         2 │ import * as mod from 'https://unpkg.com/[email protected]/esm/standalone.mjs'
           ╵                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   
   error: Uncaught (in promise) Error: Build failed with 1 error:
   islands/Counter.tsx:2:21: ERROR: [plugin: deno-loader] Requires import access to "unpkg.com:443", run again with the --allow-import flag
     let error = new Error(text);
                 ^
       at failureErrorWithLog (https://deno.land/x/[email protected]/mod.js:1626:15)
       at https://deno.land/x/[email protected]/mod.js:1034:25
       at runOnEndCallbacks (https://deno.land/x/[email protected]/mod.js:1461:45)
       at buildResponseToResult (https://deno.land/x/[email protected]/mod.js:1032:7)
       at https://deno.land/x/[email protected]/mod.js:1061:16
       at responseCallbacks.<computed> (https://deno.land/x/[email protected]/mod.js:679:9)
       at handleIncomingPacket (https://deno.land/x/[email protected]/mod.js:739:9)
       at readFromStdout (https://deno.land/x/[email protected]/mod.js:655:7)
       at https://deno.land/x/[email protected]/mod.js:1974:11
       at eventLoopTick (ext:core/01_core.js:175:7)
   

I'm not sure where/how this --allow-import flag should be supplied — the build task is already running with -A, which I'd assume would allow imports from anywhere. Changing build to deno run --allow-import=unpkg.com:443,deno.land:443,esm.sh:443,jsr.io:443 -RWEN --allow-run dev.ts build still gives the same error.

[mindon]

facing the same issue

[hillars]

I had similar issue with SheetJS.

This import will fail:
import * as XLSX from 'https://cdn.sheetjs.com/xlsx-0.20.3/package/xlsx.mjs';

Did not get it working with --allow-import
Current workaround for me is:

1. Download the library into a local file in the project.
2. Update deno.json imports:

"imports": {
    "$xlsx": "./xlsx.mjs"
}

3. Use this for importing: import * as XLSX from "$xlsx";

[myty]

I had similar issue with SheetJS.

This import will fail: import * as XLSX from 'https://cdn.sheetjs.com/xlsx-0.20.3/package/xlsx.mjs';

Did not get it working with --allow-import Current workaround for me is:

1. Download the library into a local file in the project.
2. Update deno.json imports:

"imports": {
    "$xlsx": "./xlsx.mjs"
}

3. Use this for importing: import * as XLSX from "$xlsx";

I'm hitting the same issue but with deno lint. Since deno lint does not actually have an --allow-import flag, I'm at a loss.