Should sources be tracked?

[dchacke]

Importmap doesn’t seem to track any sources so running update can trigger a download from a different source than the one from which a package was originally installed.

$ bin/importmap pin imask@7.6.0 --from unpkg
Pinning "imask" to vendor/javascript/imask.js via download from https://unpkg.com/imask@7.6.0/esm/index.js

$ bin/importmap update 
Pinning "imask" to vendor/javascript/imask.js via download from https://ga.jspm.io/npm:imask@7.6.1/esm/index.js

There’s no guarantee that different sources serve the same files. For example, https://ga.jspm.io/npm:imask@7.6.1/esm/index.js is different from https://unpkg.com/imask@7.6.1/esm/index.js

I suggest keeping track of the source for each dependency and reusing it when updating. SO user Alex suggests an implementation here (under update 2).