esm.sh icon indicating copy to clipboard operation
esm.sh copied to clipboard
verified publisher icon esm-dev

Failed to import - deno lockfile validity breaks over time

Open felipecrs opened this issue 2 years ago • 3 comments

This is the second time this happens so I decided to report it. Apparently, esm.sh likes to change the redirected URL out of the blue and that breaks deno's lockfile validity, which by consequence breaks CI/CD pipelines which are relying on it.

Deno: 1.38.3

Dependency import:

import * as cheerio from "https://esm.sh/[email protected]";

This was my deno.lock:

{
  "remote": {
    "https://esm.sh/[email protected]": "e29ac0ecb0d38bb61d6a1e299a947bae9acc34607cd9e13fc2668fe151be2e47",
    "https://esm.sh/v130/[email protected]/denonext/boolbase.mjs": "4e3bd67e9b1c5c55094eae98345d0107c6a44ef57bd3d4b9579698fa44722280",
    "https://esm.sh/v130/[email protected]/denonext/cheerio-select.mjs": "26d0d90b8e6f0a1738de0a609f7f710679e5ee476fe79bf955ce0f4bd6f7ff4a",
    "https://esm.sh/v130/[email protected]/denonext/cheerio.mjs": "bfe346289cc70115726eabf64a63239d0ce1f19e57c8dafd6dde03122415d37f",
    "https://esm.sh/v130/[email protected]/denonext/lib/utils.js": "9af7227ef1292e39e286447485157d309c927c97d77bb1ae87d2c31a810310c1",
    "https://esm.sh/v130/[email protected]/denonext/css-select.mjs": "2b78a5922d67baf089161edbdfb88cc32bc103cef9022604248b1eb7beeb7508",
    "https://esm.sh/v130/[email protected]/denonext/css-what.mjs": "283d02df6fef73d3223b55324b559b363dd0e4c008ea1efbcf9f14b8f2642202",
    "https://esm.sh/v130/[email protected]/denonext/dom-serializer.mjs": "0c6c6178ae63afea0c1b9efe30c086a57f4014f8d15fcb482e2ade889b72fca3",
    "https://esm.sh/v130/[email protected]/denonext/domelementtype.mjs": "371936c356d5ac797f2ce3a66b98dfc73e6fff0e095b2858b85668e6ad7d10e0",
    "https://esm.sh/v130/[email protected]/denonext/domhandler.mjs": "ee6bcae3bdc3bd7a0f125cd6db6f862abe96389cf26b14db014931de01dd212d",
    "https://esm.sh/v130/[email protected]/denonext/domutils.mjs": "a6a4b1ae2cb5ea24c42a276f0f589eb2432899dd59af0c90ce13da0297b35d55",
    "https://esm.sh/v130/[email protected]/denonext/entities.mjs": "ecd26e1d8c8b97abb78810721f9ac41039743e6903f4abae6375f1c3e6ea55a5",
    "https://esm.sh/v130/[email protected]/denonext/lib/decode.js": "7fea6d8bd725edbbf7ea05031d2ea1bbbc1166dc11e3345d541198dd2dc16f1e",
    "https://esm.sh/v130/[email protected]/denonext/lib/escape.js": "7ebdc622bf3618bab25db40da4a49e2b9d03f044745f125f0bc3359f2d060def",
    "https://esm.sh/v130/[email protected]/denonext/htmlparser2.mjs": "86485bc3df8e6500954be1f7afca3de1c1e1bd5c62a65b427524185b356b7730",
    "https://esm.sh/v130/[email protected]/denonext/nth-check.mjs": "759eee1446f0a783dfb37f0ee7eaca118e35d068f0d359bf4cd5a0196c8c9a0e",
    "https://esm.sh/v130/[email protected]/denonext/parse5-htmlparser2-tree-adapter.mjs": "612413d2963183c89b4bc0a01f77e77498d53c5f151e7439a9f49840ba798638",
    "https://esm.sh/v130/[email protected]/denonext/parse5.mjs": "ef368d62b5bea56abd77fcc04e7e07b784cf57a629dd1d6df69ef1b4122c3393"
  }
}

The workaround is to rm -rf ~/.cache/deno && deno cache --lock-write deps.ts:

{
  "remote": {
    "https://esm.sh/[email protected]": "f2df09a207094c060115470643b70099ef967dba5238de17bdc6bb820cb9ac0d",
    "https://esm.sh/v135/[email protected]/denonext/boolbase.mjs": "4e3bd67e9b1c5c55094eae98345d0107c6a44ef57bd3d4b9579698fa44722280",
    "https://esm.sh/v135/[email protected]/denonext/cheerio-select.mjs": "5b882e2ef61d79044badb386948403758e0b171f54bcd2f4975c502c8096a2df",
    "https://esm.sh/v135/[email protected]/denonext/cheerio.mjs": "857011c7a0c086bf86d6215e73851251dce13d4489d82b9a614de34d2696ce41",
    "https://esm.sh/v135/[email protected]/denonext/lib/utils.js": "23db4ab02bf34f134210e809b1bd4e8bc0115ce79dc0581d7a47e1a6b39fb379",
    "https://esm.sh/v135/[email protected]/denonext/css-select.mjs": "7f4fb680eff2223a68fb5a1efa12e905077d7e6c44ae66c01fc437fe7af58f8b",
    "https://esm.sh/v135/[email protected]/denonext/css-what.mjs": "283d02df6fef73d3223b55324b559b363dd0e4c008ea1efbcf9f14b8f2642202",
    "https://esm.sh/v135/[email protected]/denonext/dom-serializer.mjs": "700001f5fdb9f72fc7d1f169be700489ddd7f19489b58b6e8691ff1fca9000fe",
    "https://esm.sh/v135/[email protected]/denonext/domelementtype.mjs": "371936c356d5ac797f2ce3a66b98dfc73e6fff0e095b2858b85668e6ad7d10e0",
    "https://esm.sh/v135/[email protected]/denonext/domhandler.mjs": "8c6e56c4596bbe7e9fd9d615f8fcdec7f11075f217bdc966a02ebe89c01b9f6f",
    "https://esm.sh/v135/[email protected]/denonext/domutils.mjs": "2a86554cc5f543a068bbf6ea6ed0647f4ad4c3ccb555f0da9fae09180cd7b611",
    "https://esm.sh/v135/[email protected]/denonext/entities.mjs": "a9e8f9c22022c34755d1189030ac30c68545ccf8532fa32654c50fe9d90a13a1",
    "https://esm.sh/v135/[email protected]/denonext/lib/decode.js": "7fea6d8bd725edbbf7ea05031d2ea1bbbc1166dc11e3345d541198dd2dc16f1e",
    "https://esm.sh/v135/[email protected]/denonext/lib/escape.js": "7ebdc622bf3618bab25db40da4a49e2b9d03f044745f125f0bc3359f2d060def",
    "https://esm.sh/v135/[email protected]/denonext/htmlparser2.mjs": "219a31d81c87d8ea21bec9be33d0d03bb8942c8b79fb8b9e2e6a05b826fc24dc",
    "https://esm.sh/v135/[email protected]/denonext/nth-check.mjs": "638b4f5a22236cd05c7d1d43e5c6ea719695c4a8bc7beccdf8d97a434bea96dc",
    "https://esm.sh/v135/[email protected]/denonext/parse5-htmlparser2-tree-adapter.mjs": "2e8c24c6859e24e7c0f1e634574f8c014860868a603e85430b98212460e25091",
    "https://esm.sh/v135/[email protected]/denonext/parse5.mjs": "35bb04ec36a1c25c8cd8137296d64d16fd523a8ad1c2b63c41ba867fcd455c36"
  }
}

I believe esm.sh should be more friendly to lockfiles, no?

Unless I'm missing something, in which case, I'd appreciate if you can let me know.

felipecrs avatar Nov 30 '23 19:11 felipecrs

please pin the build version:

import * as cheerio from "https://esm.sh/v135/[email protected]";
// or
import * as cheerio from "https://esm.sh/[email protected]?pin=v135";

ije avatar Nov 30 '23 20:11 ije

import * as cheerio from "https://esm.sh/v135/[email protected]";

This does not work either because the hashes apparently differ. This is exactly what I had done the first time this issue happened. Here is how it is in my repository right now, which started to fail this afternoon.

import * as cheerio from "https://esm.sh/v130/[email protected]";

deno.lock:

{
  "remote": {
    "https://esm.sh/v130/[email protected]/denonext/boolbase.mjs": "4e3bd67e9b1c5c55094eae98345d0107c6a44ef57bd3d4b9579698fa44722280",
    "https://esm.sh/v130/[email protected]/denonext/cheerio-select.mjs": "26d0d90b8e6f0a1738de0a609f7f710679e5ee476fe79bf955ce0f4bd6f7ff4a",
    "https://esm.sh/v130/[email protected]": "e29ac0ecb0d38bb61d6a1e299a947bae9acc34607cd9e13fc2668fe151be2e47",
    "https://esm.sh/v130/[email protected]/denonext/cheerio.mjs": "bfe346289cc70115726eabf64a63239d0ce1f19e57c8dafd6dde03122415d37f",
    "https://esm.sh/v130/[email protected]/denonext/lib/utils.js": "9af7227ef1292e39e286447485157d309c927c97d77bb1ae87d2c31a810310c1",
    "https://esm.sh/v130/[email protected]/denonext/css-select.mjs": "2b78a5922d67baf089161edbdfb88cc32bc103cef9022604248b1eb7beeb7508",
    "https://esm.sh/v130/[email protected]/denonext/css-what.mjs": "283d02df6fef73d3223b55324b559b363dd0e4c008ea1efbcf9f14b8f2642202",
    "https://esm.sh/v130/[email protected]/denonext/dom-serializer.mjs": "0c6c6178ae63afea0c1b9efe30c086a57f4014f8d15fcb482e2ade889b72fca3",
    "https://esm.sh/v130/[email protected]/denonext/domelementtype.mjs": "371936c356d5ac797f2ce3a66b98dfc73e6fff0e095b2858b85668e6ad7d10e0",
    "https://esm.sh/v130/[email protected]/denonext/domhandler.mjs": "ee6bcae3bdc3bd7a0f125cd6db6f862abe96389cf26b14db014931de01dd212d",
    "https://esm.sh/v130/[email protected]/denonext/domutils.mjs": "a6a4b1ae2cb5ea24c42a276f0f589eb2432899dd59af0c90ce13da0297b35d55",
    "https://esm.sh/v130/[email protected]/denonext/entities.mjs": "ecd26e1d8c8b97abb78810721f9ac41039743e6903f4abae6375f1c3e6ea55a5",
    "https://esm.sh/v130/[email protected]/denonext/lib/decode.js": "7fea6d8bd725edbbf7ea05031d2ea1bbbc1166dc11e3345d541198dd2dc16f1e",
    "https://esm.sh/v130/[email protected]/denonext/lib/escape.js": "7ebdc622bf3618bab25db40da4a49e2b9d03f044745f125f0bc3359f2d060def",
    "https://esm.sh/v130/[email protected]/denonext/htmlparser2.mjs": "86485bc3df8e6500954be1f7afca3de1c1e1bd5c62a65b427524185b356b7730",
    "https://esm.sh/v130/[email protected]/denonext/nth-check.mjs": "759eee1446f0a783dfb37f0ee7eaca118e35d068f0d359bf4cd5a0196c8c9a0e",
    "https://esm.sh/v130/[email protected]/denonext/parse5-htmlparser2-tree-adapter.mjs": "612413d2963183c89b4bc0a01f77e77498d53c5f151e7439a9f49840ba798638",
    "https://esm.sh/v130/[email protected]/denonext/parse5.mjs": "ef368d62b5bea56abd77fcc04e7e07b784cf57a629dd1d6df69ef1b4122c3393"
  }
}

❯ deno cache deps.ts
error: The source code is invalid, as it does not match the expected hash in the lock file.
  Specifier: https://esm.sh/v130/[email protected]
  Lock file: /home/felipe/repos/website/changelog-generator/deno.lock

If I regenerate the lockfile:

{
  "remote": {
    "https://esm.sh/v130/[email protected]/denonext/boolbase.mjs": "4e3bd67e9b1c5c55094eae98345d0107c6a44ef57bd3d4b9579698fa44722280",
    "https://esm.sh/v130/[email protected]/denonext/cheerio-select.mjs": "26d0d90b8e6f0a1738de0a609f7f710679e5ee476fe79bf955ce0f4bd6f7ff4a",
-   "https://esm.sh/v130/[email protected]": "e29ac0ecb0d38bb61d6a1e299a947bae9acc34607cd9e13fc2668fe151be2e47",
+   "https://esm.sh/v130/[email protected]": "23c393b3f6fed59203c090e7dfd179109819966db7a63cdd2a634987d01b93a6", 
    "https://esm.sh/v130/[email protected]/denonext/cheerio.mjs": "bfe346289cc70115726eabf64a63239d0ce1f19e57c8dafd6dde03122415d37f",
    "https://esm.sh/v130/[email protected]/denonext/lib/utils.js": "9af7227ef1292e39e286447485157d309c927c97d77bb1ae87d2c31a810310c1",
    "https://esm.sh/v130/[email protected]/denonext/css-select.mjs": "2b78a5922d67baf089161edbdfb88cc32bc103cef9022604248b1eb7beeb7508",
    "https://esm.sh/v130/[email protected]/denonext/css-what.mjs": "283d02df6fef73d3223b55324b559b363dd0e4c008ea1efbcf9f14b8f2642202",
    "https://esm.sh/v130/[email protected]/denonext/dom-serializer.mjs": "0c6c6178ae63afea0c1b9efe30c086a57f4014f8d15fcb482e2ade889b72fca3",
    "https://esm.sh/v130/[email protected]/denonext/domelementtype.mjs": "371936c356d5ac797f2ce3a66b98dfc73e6fff0e095b2858b85668e6ad7d10e0",
    "https://esm.sh/v130/[email protected]/denonext/domhandler.mjs": "ee6bcae3bdc3bd7a0f125cd6db6f862abe96389cf26b14db014931de01dd212d",
    "https://esm.sh/v130/[email protected]/denonext/domutils.mjs": "a6a4b1ae2cb5ea24c42a276f0f589eb2432899dd59af0c90ce13da0297b35d55",
    "https://esm.sh/v130/[email protected]/denonext/entities.mjs": "ecd26e1d8c8b97abb78810721f9ac41039743e6903f4abae6375f1c3e6ea55a5",
    "https://esm.sh/v130/[email protected]/denonext/lib/decode.js": "7fea6d8bd725edbbf7ea05031d2ea1bbbc1166dc11e3345d541198dd2dc16f1e",
    "https://esm.sh/v130/[email protected]/denonext/lib/escape.js": "7ebdc622bf3618bab25db40da4a49e2b9d03f044745f125f0bc3359f2d060def",
    "https://esm.sh/v130/[email protected]/denonext/htmlparser2.mjs": "86485bc3df8e6500954be1f7afca3de1c1e1bd5c62a65b427524185b356b7730",
    "https://esm.sh/v130/[email protected]/denonext/nth-check.mjs": "759eee1446f0a783dfb37f0ee7eaca118e35d068f0d359bf4cd5a0196c8c9a0e",
    "https://esm.sh/v130/[email protected]/denonext/parse5-htmlparser2-tree-adapter.mjs": "612413d2963183c89b4bc0a01f77e77498d53c5f151e7439a9f49840ba798638",
    "https://esm.sh/v130/[email protected]/denonext/parse5.mjs": "ef368d62b5bea56abd77fcc04e7e07b784cf57a629dd1d6df69ef1b4122c3393"
  }
}

So, as you can see, even pinning the build is not enough as the hash apparently changes anyway.

felipecrs avatar Nov 30 '23 21:11 felipecrs

PS: Sorry, I should have reported this hash issue since the beginning.

felipecrs avatar Nov 30 '23 21:11 felipecrs

It just happened again btw.

felipecrs avatar Apr 19 '24 13:04 felipecrs

For my specific use case, I was able to use npm instead: npm:[email protected]. Feel free to close this issue if there's no intention to resolve it.

felipecrs avatar Apr 19 '24 13:04 felipecrs

sorry i don't think i have a good resolution for this, since the server builds modules dynamically, if the cache at edge is expired and we are updating the server, the module js may change (e.g. esbuild has different build outout with different versions). i suggest you switch to npm: specifier or using --no-lock

ije avatar Apr 19 '24 14:04 ije