Transitive uplink dependencies provide a 404 error

[dherman]

Your Environment

• verdaccio version: 5.26.3
• node version [12.x.x, 14.x.x]: v18.18.0
• package manager: npm@9
• os: linux
• platform: GitHub Actions (Docker)

Describe the bug

When run in GitHub Actions, Verdaccio presents a 404 error for a transitive dependency (in this case, @types/yargs-parser) that should be passed through from an npm uplink proxy.

One notable fact is that I believe this is a library that has multiple versions in the dependency graph, so this may be an example of the same bug as #3530.

To Reproduce

Example repository

See .github/workflows/ci.yml to see what this example does in GitHub Actions. In brief:

• The proxy is run with the proxy/proxy.sh script using the proxy/config.yml config file.
• Then a dummy user is authenticated in order to publish packages to Verdaccio.
• Next the super-duper-library package is published to the Verdaccio proxy.
• Finally, the test/smoke-test package is built, using the Verdaccio proxy.

Expected behavior

The above steps should succeed because the Verdaccio proxy should be serving the one super-duper-library package and all other dependencies should be passed through successfully from the npm uplink.

Screenshots, server logs, package manager log

Complete GitHub Actions log

Configuration File

storage: ./storage
auth:
  htpasswd:
    file: ./htpasswd
uplinks:
  npmjs:
    url: https://registry.npmjs.org/
    timeout: 120s
packages:
  'super-duper-library':
    access: $all
    publish: $all
  '**':
    access: $all
    publish: $authenticated
    proxy: npmjs
log: { type: file, path: proxy.log, level: info }

Environment information

Environment Info:
  System:
    OS: Linux 6.2 Ubuntu 22.04.3 LTS 22.04.3 LTS (Jammy Jellyfish)
    CPU: (2) x64 Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  Binaries:
    npm: 9.8.1 - /opt/hostedtoolcache/node/18.18.0/x64/bin/npm
  Virtualization:
    Docker: 24.0.6 - /usr/bin/docker
  Browsers:
    Chrome: 117.0.5938.132

Contribute to Verdaccio

• I'm willing to fix this bug 🥇

[dherman]

I noticed that this particular error message in the above screenshot looks a bit suspicious:

npm ERR! 404  '@types/yargs-parser@http://127.0.0.1:4873/@types/yargs-parser/-/yargs-parser-21.0.1.tgz' is not in this registry.

The @types/yargs-parser@http://etc part seems fishy, doesn't it? Could this maybe suggest there's a bug in uplinks having something to do with the @ or / characters?

[dherman]

Let me also try this with the latest pre-release of verdaccio 6 and see if that does anything.

Edit: No, that didn't change anything.

[luban-130]

I also have this situation. After setting uplinks, when downloading non-existent packages from verdaccio, the download and cache from uplinks will not be cached in verdaccio.