npm is not resolving all dependencies to internal registry

[orphaner]

Hy there,

I'm opening this issue because:

• npm is producing an incorrect install.

What's going wrong?

I am using npm to build projects of my current customer. We have an internal registry (Nexus 3.1) to:

• resolve all packages in our network instead of having to download them all again (and again) to the npm registry
• make sure all previously used packages are always present (I have in mind the left-pad issue)
• store our packages once they are released

One another important fact: the build agents does not have a direct internet access, they can only resolve dependencies via the internal registry.
Dependencies to direct github project are not allowed.

=> My problem is that for some transient dependencies, npm is resolving the dependency to registry.npmjs.org instead of my internal registry: the build is stuck trying to access the internet.
My understanding on setting a registry is that all dependencies must be resolved to that registry (like maven do). Here it is not the case.

How can the CLI team reproduce the problem?

Here the gist of my project: https://gist.github.com/orphaner/549355007385cf9b4b824c5269916936 . You'll find the package.json, the verbose log and the npm-shrinkwrap.json file.

For example, you'll see that for no obvious reason, the package adm-zip is resolved to registry.npmjs.org instead of my internal registry.
If I try to execute npm install adm-zip in a empty folder: my internal registry is used as expected.

supporting information:

• npm -v prints: 4.0.2
• node -v prints: v9.6.1
• npm config get registry prints: http://registry.mydomain.com/repository/npm-group
• Windows, OS X/macOS, or Linux?: Windows & Linux

I hope you'll help me to resolve this bug.
Please let me know if you need more information/data or if you want me to experiment some bug fix or workaround.
Nicolas

[orphaner]

I forgot to mention that:

• I tried to npm cache clear before build.
• I've also tested on a fresh install.

It does not change the build result.

[legodude17]

For some reason, the from of adm-zip in npm-shrinkwrap.json is set to https://registry.npmjs.org/adm-zip/-/adm-zip-0.4.4.tgz. Try cloning it to your machine, deleting npm-shrinkwrap.json, reinstalling and then reshrinkwrapping.

[orphaner]

Hy @legodude17, thanks for you reply.
But unfortunately, it does not works. My problem is 100% reproducible.

[legodude17]

Can you put the new npm-shrinkwrap.json in another gist?

[orphaner]

here the gist with the new npm-shrinkwrap.json: https://gist.github.com/orphaner/831225129aae77382f507557e961a7c5
It is unchanged.

In the npm-shrinkwrap.json file you can count 470 dependencies resolved to my internal registry and 226 dependencies resolved to the npmjs registry.
Adm-zip is only an example of those wrongly resolved dependencies.

I've tested yarn (which can't be used in my project due to limitations) and all dependencies are correctly resolved.

IMHO the problem comes from npm itself (or the internal shrinkwrap process).

Thanks for your help

[legodude17]

I agree with @orphaner. What are your thoughts @zkat? I think it is a bug in shrinkwrap.

[zkat]

@legodude17 don't @ me <3

[legodude17]

😕 That wasn't very helpful. Can you get a repro for this @orphaner?

[zkat]

@orphaner I believe this is working as designed. Once you've shrinkwrapped a dependency to point to a particular registry, it will always try to get it from there. Did you install those before changing the registry? You might be able to just do a replace on the shrinkwrap and that might fix it for the future.

[guaido79]

Some problem here.
I'm in an enterprise continuous integration environment. When resolving some dependency npm try to fetch from https://registry.npmjs.org instead of the dedicated server inside the intranet, receiving ECONNREFUSED cause build serve can see only the internal npm server.

[orphaner]

I've switched the project to yarn which is working correctly. It is really faster too.