Is this really a better workflow? I mean it works, but now you do not have a central list of all your external dependencies. Sure they recommend you just do all your imports in a single file and re-export them. But that sounds very tedious and at the end of the day to what advantage? I'm really struggling to see it.

For scripts, it's pretty sweet to be able to import dependencies directly via URL without needing to do an `npm init` and `npm install`. For larger projects (like my static site generator), I didn't find it tedious to import from a central deps.ts file, although I admit that importing from a relative path like '../../deps.ts' is not as quite as nice as importing by package name like in Node. I'm OK with that the tradeoff, though, especially since it matches the way imports work in the browser.

What about transitive dependencies?

My question too. I assume Demo downloads one component and then all its nested dependencies. But now every nested dependency can come from a different server, just like the components you refer to can come from anywhere on the internet.

I wonder if this could be a security issue. It's hard to know who has control over all those nested repositories, and who keeps a look on them to ensure they are not maliciously modified? Is anybody checking on cryptographic signatures of them?

Only asking because I don't know much about Demo.

Locked modules have their hashes stored, so if something does change, you'll know right away. So will anybody else who got the source from you with lock.json included.

So, this is kinda unusable for any corporate setting where all dependencies, including transitive ones, are downloaded from a private server.

Er, why? You'd just set up an import map to point it at your private server.

> You'd just

Ah. The enievitable "just".

And how exactly do you set the import map to point to the private server for the transitive dependencies?

Deno's own docs don't bother with such trivialities and show a very toy example, of course, https://deno.land/manual/linking_to_external_code/import_map...

Rather than importing and re-exporting dependencies, Deno supports import maps:

https://github.com/WICG/import-maps https://deno.land/manual@v1.20.1/linking_to_external_code/im...

It seems like a feature that would be better implemented at the IDE/editor level. Paste in a URL and it asks you if you want to add it to package management.