Use local and unpublished packages

Not every dependency lives on JSR or npm. Deno has two supported ways to use code that isn't published anywhere: the links field for local directories, and plain HTTPS imports for code reachable by URL.

Link a local package with links Jump to heading#

The links field in deno.json plays the role of npm link in Node.js: it overrides a dependency with a local directory during development. Given a local package with a name, version, and exports:

{
  "name": "@acme/greeter",
  "version": "0.1.0",
  "exports": "./mod.ts"
}

export function greet(name: string): string {
  return `Hello, ${name}!`;
}

Point your application at it with links, and import it like a registry package:

{
  "links": ["../greeter"],
  "imports": {
    "@acme/greeter": "jsr:@acme/greeter@^0.1.0"
  }
}

import { greet } from "@acme/greeter";

console.log(greet("local package"));

$ deno run main.ts
Hello, local package!

The linked directory is used instead of the registry; the package doesn't even have to be published. Edits in greeter/ are picked up directly.

Import straight from an HTTPS URL Jump to heading#

Any module reachable over HTTPS can be imported directly, including raw files from a GitHub repository:

import { equal } from "https://raw.githubusercontent.com/denoland/std/cdf74a86680beb4ef74c95e0fd5d71c5d7841eb9/assert/equal.ts";

console.log(equal([1, 2], [1, 2]));

$ deno run main.ts
Download https://raw.githubusercontent.com/denoland/std/cdf74a86680beb4ef74c95e0fd5d71c5d7841eb9/assert/equal.ts
true

Pin the URL to a tag or commit hash rather than a branch, so the code can't change underneath you.

For private repositories, set DENO_AUTH_TOKENS to a personal access token scoped to the host, e.g. DENO_AUTH_TOKENS=a1b2c3d4e5f6@raw.githubusercontent.com; see Private repositories for details.

What is not supported Jump to heading#

Deno does not support git dependency specifiers (git+https:/git+ssh:) or tarball URL dependencies in package.json. Additionally, since Deno 2.8, file: and link: entries in package.json dependencies are silently skipped during npm resolution: they neither work nor error.

The supported alternatives are:

• the links field for local directories
• HTTPS imports for code hosted in a (possibly private) git repository
• vendoring remote modules you need to patch or build offline
• publishing the package to JSR or npm

For lockfiles, version ranges, and everything else about dependencies, see the packages documentation.