npm datasource caches private packages from registries that omit Cache-Control (e.g. GitHub Packages)

[ZackKanter]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.138.1

Please tell us more about your question or problem

Summary

The npm datasource caches packument responses in Renovate's shared package
cache whenever the upstream registry omits a Cache-Control header. For
GitHub Packages (https://npm.pkg.github.com) — which never sends
Cache-Control on read — this means every private @foo/* response is
cached for the full hard TTL (default 7 days). On concurrent webhook
fan-outs shortly after a publish, jobs hit the in-process soft-TTL window
(15 min default) and receive a stale packument with no network revalidation
— missing the just-published version.

Reproduction

1. Configure an npm host rule pointing at https://npm.pkg.github.com.

2. Run any job that resolves a private @foo/bar package.

3. Inspect the Redis/Valkey package cache:

   KEYS renovate:datasource-npm:cache-provider-*
   TTL  renovate:datasource-npm:cache-provider-https://npm.pkg.github.com/<org>/@foo%2Fbar
   

   The key exists with a ~604800 s TTL.

4. Publish a new version of @foo/bar.

5. Within 15 minutes, trigger another resolve job. Logs show
   localHit: 1, hit: 0, miss: 0 and Renovate resolves the old version.

Root cause

lib/modules/datasource/npm/get.ts constructs its cache provider with:

new PackageHttpCacheProvider({
  namespace: 'datasource-npm:cache-provider',
  checkAuthorizationHeader: false, // We don't rely on whether user token is provided or not
  checkCacheControlHeader: true,
  writeSchema: CachedPackument,
});

And PackageHttpCacheProvider.cacheAllowed (before the fix) reads:

if (this.checkCacheControlHeader && isString(resp.headers['cache-control'])) {
  const isPublic = /* ...parse 'public' token... */;
  if (!isPublic) return false;
}

if (this.checkAuthorizationHeader && resp.authorization) {
  return false;
}

return true;

For a GHP response:

1. cachePrivatePackages is false by default — no short-circuit.
2. checkCacheControlHeader is true, but GHP returns no
   cache-control header at all, so
   isString(resp.headers['cache-control']) is false and the entire branch
   is skipped — not treated as private.
3. checkAuthorizationHeader is hardcoded false for npm, so the
   request-auth check is also skipped.
4. Falls through to return true → the response is cached.

For registry.npmjs.org the same path returns true via the public branch
(Cache-Control: public, max-age=… is present). So public npm caches
legitimately; GHP caches by falling through every guard.

Note: cachePrivatePackages is a "force caching on regardless" admin
override — not a "refuse to cache when private" gate. The actual privacy
gate for npm is supposed to be Cache-Control, and it silently fails open
when the header is missing.

Why this can't be fixed publish-side

Response headers from https://npm.pkg.github.com are entirely controlled
by GitHub. npm publish exposes no flag that influences the read-side
Cache-Control, ETag, or Last-Modified headers, and GitHub does not
document any opt-in. Visibility, token type, and workflow changes all leave
GHP's read-side headers unchanged. This is a Renovate-side correctness gap.

Proposed fix

Require an affirmative Cache-Control: public signal before caching when
checkCacheControlHeader: true. A missing header should disallow caching
rather than fall through.

if (this.checkCacheControlHeader) {
  const cacheControl = resp.headers['cache-control'];
  const isPublic =
    isString(cacheControl) &&
    cacheControl
      .toLocaleLowerCase()
      .split(regEx(/\s*,\s*/))
      .includes('public');

  if (!isPublic) {
    return false;
  }
}

Impact:

• registry.npmjs.org: unchanged — it sends Cache-Control: public and
  continues to cache.
• GitHub Packages and other registries that omit Cache-Control: stop
  caching by default. Correctness restored; performance recoverable via
  cachePrivatePackages: true for admins who know their registry is safe
  to share.
• Maven and Typst datasources: unaffected — both set
  checkCacheControlHeader: false.

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[jamietanna]

PR #42822