{"record":{"id":"b76ecd6c4fc126d8","repo":"denoland/deno","slug":"unexpected-package-json-dependency-string-strin","errorCode":null,"errorMessage":"Unexpected package json dependency string: \"{string_value}\" in {}","messagePattern":"Unexpected package json dependency string: \"(.+?)\" in (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/pm/deps.rs","lineNumber":1165,"sourceCode":"                );\n                continue;\n              };\n              let Some(string_value) = cst_string_literal(&property) else {\n                continue;\n              };\n              let new_value = if string_value.starts_with(\"npm:\") {\n                // aliased\n                let rest = string_value.trim_start_matches(\"npm:\");\n                let mut parts = rest.split('@');\n                let first = parts.next().unwrap();\n                if first.is_empty() {\n                  let scope_and_name = parts.next().unwrap();\n                  format!(\"npm:@{scope_and_name}@{version_req}\")\n                } else {\n                  format!(\"npm:{first}@{version_req}\")\n                }\n              } else if string_value.contains(\":\") {\n                bail!(\n                  \"Unexpected package json dependency string: \\\"{string_value}\\\" in {}\",\n                  arc.path.display()\n                );\n              } else {\n                version_req.to_string()\n              };\n              property\n                .set_value(jsonc_parser::cst::CstInputValue::String(new_value));\n            }\n            DepLocation::Catalog {\n              path, key_paths, ..\n            } => {\n              let updater =\n                get_or_create_updater(&mut config_updaters, &dep.location)?;\n              if !updater\n                .update_catalog_entry(key_paths, &version_req.to_string())\n              {\n                log::warn!(","sourceCodeStart":1147,"sourceCodeEnd":1183,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/pm/deps.rs#L1147-L1183","documentation":"When the dependency manager rewrites a version in package.json, it handles `npm:`-aliased entries and plain versions. Any other value containing `:` — `jsr:@scope/pkg@^1`, `http:...`, `git+ssh:...` — hits this bail because rewriting it would corrupt an unsupported scheme.","triggerScenarios":"`deno add`/`deno remove`/`deno install` updating a package.json whose dependencies/devDependencies contain a non-npm scheme string, e.g. `\"my-lib\": \"jsr:@scope/my-lib@^1.0.0\"`. A hand-edited package.json using jsr: or a git URL where a plain version is expected.","commonSituations":"Mixed Deno/npm projects that stored JSR deps in package.json; copying an import-map entry into package.json dependencies; converting npm deps to jsr without moving them to deno.json imports.","solutions":["Move `jsr:` dependencies into deno.json `imports` and keep plain npm versions in package.json.","For npm-aliased entries keep the `npm:name` form (supported) rather than other schemes.","After editing, re-run the original command to confirm the rewrite succeeds."],"exampleFix":"// package.json (before)\n{\n  \"dependencies\": { \"my-lib\": \"jsr:@scope/my-lib@^1.0.0\" }\n}\n// deno.json (after)\n{\n  \"imports\": { \"my-lib\": \"jsr:@scope/my-lib@^1.0.0\" }\n}\n// package.json (after)\n{\n  \"dependencies\": {}\n}","handlingStrategy":"validation","validationCode":"const pkg = JSON.parse(readFileSync(\"package.json\", \"utf8\"));\nconst deps = { ...pkg.dependencies, ...pkg.devDependencies };\nconst bad = Object.entries(deps).filter(([, v]) => v.includes(\":\") && !String(v).startsWith(\"npm:\"));\nif (bad.length) {\n  console.error(`non-npm specifiers in package.json: ${bad.map(([k, v]) => `${k}@${v}`).join(\", \")}`);\n  process.exit(1);\n}","typeGuard":"const isRewritablePkgJsonDep = (v: string): boolean =>\n  !v.includes(\":\") || v.startsWith(\"npm:\");","tryCatchPattern":null,"preventionTips":["Store jsr:/http:/git specifiers in deno.json imports, never in package.json dependencies.","Only `npm:`-prefixed aliases and plain semver strings are safe in package.json for the Deno updater.","Lint mixed projects for cross-registry specifier leaks in CI."],"tags":["package-json","dependencies","jsr","npm"],"backgroundTag":"invalid-dependency-specifier","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}