Check enginesNode from private repositories

[yadickson]

Hello,

I have a project to use private libraries, when I used the command:

ncu --target semver -u

 @private-repo/lib1             ^0.82.4  →  ^0.82.5

everything's fine

But, when try to check engines

ncu --enginesNode --target semver -u

The process says

 @private-repo/lib1             ^0.82.4  →  ^0.82.5

ZP: 404 Not Found - GET https://registry.npmjs.org/@private-repo/lib1/0.82.5
    at ./node_modules/npm-check-updates/build/index.js:365:974
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Module.Pl [as getEngines] (./node_modules/npm-check-updates/build/index.js:424:1967)
    at async ./node_modules/npm-check-updates/build/index.js:534:894 {
  headers: [Object: null prototype] {
    date: [ 'Fri, 28 Mar 2025 14:12:54 GMT' ],
    'content-type': [ 'application/json' ],
    'content-length': [ '11' ],
    connection: [ 'keep-alive' ],
    'cf-ray': [ '9277b99d389eb51f-SCL' ],
    'access-control-allow-origin': [ '*' ],
    vary: [ 'Accept-Encoding' ],
    'set-cookie': [
      '_cfuvid=e8WlVX.5s6C9XcQJrBynw1M9ZlEyOxldMo97ecB.uO8-1743171174186-0.0.1.1-604800000; path=/; domain=.npmjs.org; HttpOnly; Secure; SameSite=None'
    ],
    server: [ 'cloudflare' ],
    'x-fetch-attempts': [ '1' ]
  },
  statusCode: 404,
  code: 'E404',
  method: 'GET',
  uri: 'https://registry.npmjs.org/@private-repo/lib1/0.82.5',
  body: 'Not Found',
  pkgid: '@private-repo/lib1'
}

Unhandled Rejection!

the library use engines config into the packages.json and my project too.

"engines": {
    "node": "^18"
  },

I am using

node@18.20.8
npm@10.8.2
ncu@17.1.16

My .npmrc

@private-repo:registry=https://gitlab.private-repo.tech/api/v4/projects/12345/packages/npm/
//gitlab.private-repo.tech/api/v4/projects/12345/packages/npm/:_authToken=super-secret-token

Thanks for your time
Best regards.

[raineorshine]

Hi, thanks for reporting.

It appears that the engines fetcher is not using the registry auth you have configured for some reason. For reference, this happens here:

npm-check-updates/src/package-managers/npm.ts

Lines 706 to 710 in 5390b5d

	{
	...npmConfigLocal,
	...npmConfig,
	...(options.registry ? { registry: options.registry, silent: true } : null),
	},

Could you run with --verbose and post the information here? That will tell us where the npmrc is found and how it is being merged.

[yadickson]

Hello,

When use the command

ncu --enginesNode --target minor -u --verbose

Options:
{
args: [],
cacheExpiration: 10,
cacheFile: '~/.ncu-cache.json',
cli: true,
color: true,
concurrency: 8,
deep: false,
dep: [ 'prod', 'dev', 'optional', 'packageManager' ],
deprecated: true,
enginesNode: true,
errorLevel: 1,
filter: [],
format: [],
install: 'prompt',
json: false,
loglevel: 'verbose',
minimal: false,
packageManager: 'npm',
registryType: 'npm',
retry: 3,
root: true,
target: 'minor',
upgrade: true,
verbose: true,
workspace: []
}

Current versions:
{
'@private/monorepo-package': '^1.3.2'
}

npm config (user):
{
'//gitlab.private.tech/api/v4/projects/12345/packages/npm/:authToken': 'super-secret-token',
'@Private:registry': 'https://gitlab.private.tech/api/v4/projects/12345/packages/npm/',
configNames: [ 'npmrc', '.npmrc' ],
cwd: '/Users/.../root-folder',
envPrefix: /^npm_config/i,
fullMetadata: false,
globalPrefix: '/Users/.../.nvm/versions/node/v18.20.8',
globalconfig: '/Users/.../.nvm/versions/node/v18.20.8/etc/npmrc',
initModule: '/Users/.../.npm-init.js',
localPrefix: '/Users/.../root-folder',
nodeGyp: '/Users/.../.nvm/versions/node/v18.20.8/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js',
noproxy: '',
npmVersion: '10.8.2',
prefix: '/Users/.../.nvm/versions/node/v18.20.8',
userAgent: 'npm/10.8.2 node/v18.20.8 darwin x64 workspaces/false',
userconfig: '/Users/.../.npmrc'
}

Minor versions:
{
'@private/monorepo-package': '1.3.3'
}

Upgraded versions:
{
'@private/monorepo-package': '^1.3.3'
}

@private/monorepo-package ^1.3.2 → ^1.3.3
n: 404 Not Found - GET https://registry.npmjs.org/@private/monorepo-package/1.3.3
at /Users/.../root-folder/node_modules/npm-check-updates/build/index.js:365:951
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Module.Ro [as getEngines] (/Users/.../root-folder/node_modules/npm-check-updates/build/index.js:424:1967)
at async /Users/.../Documents/root-folder/node_modules/npm-check-updates/build/index.js:565:888 {
headers: [Object: null prototype] {
date: [ 'Tue, 24 Jun 2025 13:10:37 GMT' ],
'content-type': [ 'application/json' ],
'content-length': [ '11' ],
connection: [ 'keep-alive' ],
'cf-ray': [ '954c7763fe83e79b-SCL' ],
'access-control-allow-origin': [ '*' ],
vary: [ 'Accept-Encoding' ],
'set-cookie': [
'_cfuvid=BKwkS8AHqGUARs7oDdVFFAr8jqZZkohpZ.efpnaK_VA-1750770637667-0.0.1.1-604800000; path=/; domain=.npmjs.org; HttpOnly; Secure; SameSite=None'
],
server: [ 'cloudflare' ],
'x-fetch-attempts': [ '1' ]
},
statusCode: 404,
code: 'E404',
method: 'GET',
uri: 'https://registry.npmjs.org/@private/monorepo-package/1.3.3',
body: 'Not Found',
pkgid: '@private/monorepo-package'
}

I use

node@18.20.8
npm@10.8.2
ncu@18.0.1

Thanks

[raineorshine]

Thanks!

So it looks like it is successfully reading your user npmconfig which contains the private registry url. However, for some reason the engines request is still using registry.npmjs.org. This suggests that the registry is being overridden or npm-registry-fetch is being given incorrect options and thus picking the wrong registry.

Unfortunately it's difficult for me to pinpoint the problem without being able to reproduce it on my end. If you're willing to do a little troubleshooting, I believed you'd be able to identify the problem pretty quickly.

I would console.log the arguments and return value of the npmRegistryFetch.pickRegistry call, and trace upwards to find where the registry is being overridden.

git clone --depth=1 https://github.com/raineorshine/npm-check-updates
cd npm-check-updates
npm install
npm run build
npx ts-node src/bin/cli.ts --cwd /path/to/project --enginesNode --target semver

Let me know if you are interested in giving this a try, and I can assist you in setting up.

[yadickson]

Ok

I added console.log into the code:
The npmRegistryFetch.pickRegistry is OK.

registry -------------- https://gitlab.private.tech/api/v4/projects/12345/packages/npm/

The problem is when try to get engines in gitlab

Redirect to npmjs when try to get information from particular version.

Redirect code

My workaround is the next:

When execute the command:

npx ts-node src/bin/cli.ts --cwd ~/project --enginesNode --target semver

The result is:

Using config file /Users/.../npm-check-updates/.ncurc.js
Checking ~/project/package.json
[====================] 39/39 100%

Patch   Backwards-compatible bug fixes
 @private/monorepo-package            ^1.3.2  →   ^1.3.5
 @types/supertest                         ^2.0.15  →  ^2.0.16
 ts-mock-imports                          ^1.3.16  →  ^1.3.17
 ts-sinon                                  ^2.0.1  →   ^2.0.2

Minor   Backwards-compatible features
 jackson-js    ^1.0.0  →  ^1.1.0
 ts-enum-util  ^4.0.0  →  ^4.1.0
 yup           ^1.0.0  →  ^1.6.1
[====================] 30/30 100%

Run npx npm-check-updates --cwd ~/project  --enginesNode --target semver -u to upgrade ~/project/package.json

Best regards

[raineorshine]

Interesting results, thanks. I guess the private gitlab registry does not support /${version}?

I'm hesitant to replace the current fetch with versions since it's probably quite a bit slower than fetching a single version. However, maybe if we only used /${version} on registry.npmjs.org where we know it is supported that would be a reasonable solution.

Thoughts?