They can include the protocol, it’s that regardless of what’s put in there it’ll use https, which is explained with examples both in the following sentences and

They can include the protocol, it’s that regardless of what’s put in there it’ll use https, which is explained with examples both in the following sentences and then in more detail in a linked doc. > For repositories on GitHub, GitLab, and Bitbucket, a specifier now names a repository rather than choosing a transport. github:owner/repo, owner/repo, git+https://…, and git+ssh://git@… all resolve through the host's canonical HTTPS URL, and the lockfile never records an SSH URL for those hosts. To reach a private hosted repository over SSH, configure the machine with git's own URL rewriting: git config --global url."git@github.com:".insteadOf https://github.com/ > pnpm shells out to git, so the rewrite applies to all of its git operations. Unknown hosts keep their exact URL, SSH included, and a URL with embedded credentials is kept verbatim and never resolves to a host archive. Details in How git dependencies are resolved.