bug: dist-tag get out of sync with upstream registry

[89ao]

Your Environment

• verdaccio version: v5.21.1
• node version [12.x.x, 14.x.x]:v12.18.4
• package manager: [npm@7, pnpm@6, yarn@2] 6.14.6
• os: [mac, windows@10, linux] CentOS Linux release 7.2 (Final)
• platform: [npm, docker, helm, other] docker

Describe the bug

Recently, we found that the metadata information of the local repository is inconsistent with that of the official package.

This caused our users to install packages that did not meet their expectations.

After some debugging ,I found that the package.json file context is like below:

        "users": {},
        "dist-tags": {
                "latest": "3.0.0-alpha.7-for-vscode",
                "next": "3.0.0-alpha.9-for-vscode"
        },

However, the correct content should actually be:

        "dist-tags": {
                "latest": "2.8.8",
                "next": "3.0.0-alpha.12"
        },

But once I delete this package.json, the content is correct when it's automatically generated.

To Reproduce

Actually , there are absolutely no reproducible clues available.

Expected behavior

1. How to fix all packages.json files?
2. How to solve the problem of "syncing issue"?

Screenshots, server logs, package manager log

Configuration File (cat ~/.config/verdaccio/config.yaml)

storage: /repo/npm/verdaccio/storage
http_proxy: http://x.x.x.x:3128
https_proxy: http://x.x.x.x:3128
no_proxy: localhost,127.0.0.1
plugins: ./plugins
url_prefix: /npm/
max_body_size: 10mb

listen:
   -  0.0.0.0:4873

web:
  title: TXX-NPM

auth:
  htpasswd:
    file: ./htpasswd
    max_users: -1

uplinks:
  npmjs:
    url: https://registry.npmjs.org/
    maxage: 4m
    timeout: 10s
    agent_options:
      keepAlive: true
      maxSockets: 40
      maxFreeSockets: 10
packages:
  '@*/*':
    # scoped packages
    access: $all
    publish: $authenticated
    proxy: npmjs

  '**':
    access: $all
    publish: $authenticated
    proxy: npmjs

middlewares:
  audit:
    enabled: true
server:
  keepAliveTimeout: 60

# log settings
logs:
  - {type: stdout, format: pretty, level: http}

Environment information

Debugging output

• $ NODE_DEBUG=request verdaccio display request calls (verdaccio <--> uplinks)
• $ DEBUG=verdaccio* verdaccio enable extreme verdaccio debug mode (verdaccio api)
• $ npm -ddd prints:
• $ npm config get registry prints:

Contribute to Verdaccio

• I'm willing to fix this bug 🥇

[juanpicado]

Reproduced, It might be fixed with 6.x versions, I'll check if is fixable on 5.x versions.

[89ao]

thanks @juanpicado