Skip to content

fix(update): drop install-v1 Accept header on dist-tag fetch#10

Merged
scottlovegrove merged 2 commits into
mainfrom
scottl/fix-fetch-406
May 9, 2026
Merged

fix(update): drop install-v1 Accept header on dist-tag fetch#10
scottlovegrove merged 2 commits into
mainfrom
scottl/fix-fetch-406

Conversation

@scottlovegrove
Copy link
Copy Markdown
Collaborator

@scottlovegrove scottlovegrove commented May 9, 2026

Summary

fetchLatestVersion was sending Accept: application/vnd.npm.install-v1+json on the dist-tag endpoint (/<package>/<tag>). The npm registry rejects that combination with HTTP 406 — the abbreviated metadata format only applies to the package-doc endpoint (/<package>), not dist-tag resolutions.

Reproduced live:

$ curl -sS -o /dev/null -w "%{http_code}\n" https://registry.npmjs.org/@doist/todoist-cli/latest
200
$ curl -sS -o /dev/null -w "%{http_code}\n" -H "Accept: application/vnd.npm.install-v1+json" https://registry.npmjs.org/@doist/todoist-cli/latest
406

In production this surfaced as:

$ td update
✖ Checking for updates...
Error: UPDATE_CHECK_FAILED
Failed to check for updates: Registry request failed (HTTP 406)

The dist-tag endpoint already returns a small single-version document, so the abbreviated-format header was never buying anything anyway — drop it.

Test plan

  • npm test — 184 tests pass; existing assertion updated; new regression test asserts fetch is called without an options argument so the bad header can't reappear silently
  • npm run check / type-check / build clean
  • Smoke against the real registry: fetchLatestVersion({ packageName: '@doist/todoist-cli', channel: 'stable' }) returns 1.62.1
  • Smoke from todoist-cli (tarball install): td update --check, td update --channel, td update --check --json all succeed against the real npm registry

🤖 Generated with Claude Code

The npm registry rejects `Accept: application/vnd.npm.install-v1+json`
on the dist-tag endpoint (`/<package>/<tag>`) with HTTP 406 — the
abbreviated metadata format only applies to the package-doc endpoint
(`/<package>`). `td update` was failing in production with
`UPDATE_CHECK_FAILED: Registry request failed (HTTP 406)`.

Drop the header; the dist-tag endpoint already returns a single small
version document, so the header was never buying anything anyway. Adds
a regression test that asserts `fetch` is called without the second
options argument.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown
Member

@doistbot doistbot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR resolves an update check failure by removing an incompatible Accept header from npm registry dist-tag requests. Catching the HTTP 406 error and adding a regression test ensures the update mechanism remains reliable in production. There is a minor opportunity to simplify the new regression test by leveraging vi.mocked(fetch) and relying on toHaveBeenCalledWith for exact argument matching rather than manually inspecting the call array.

Share FeedbackReview Logs

Comment thread src/commands/update.test.ts Outdated
`expect(fetch).toHaveBeenCalledWith(url)` already enforces an exact
argument match — it fails if a second `options` argument is passed,
which is the only way the bad `Accept` header could come back. The
manual `mock.calls[0]` array inspection added nothing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@scottlovegrove scottlovegrove merged commit 4a7b36f into main May 9, 2026
3 checks passed
@scottlovegrove scottlovegrove deleted the scottl/fix-fetch-406 branch May 9, 2026 12:29
doist-release-bot Bot added a commit that referenced this pull request May 9, 2026
## [0.7.1](v0.7.0...v0.7.1) (2026-05-09)

### Bug Fixes

* **update:** drop install-v1 Accept header on dist-tag fetch ([#10](#10)) ([4a7b36f](4a7b36f))
@doist-release-bot
Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 0.7.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

scottlovegrove added a commit to Doist/todoist-cli that referenced this pull request May 9, 2026
Picks up the dist-tag fetch fix (Doist/cli-core#10) — `td update` was
failing with `UPDATE_CHECK_FAILED: HTTP 406` because cli-core 0.7.0 sent
the abbreviated-metadata `Accept` header on a dist-tag URL, which the
npm registry rejects.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants