Why are specific versions of npm packages not being downloaded from upstream source?

Viewed 1085

We have an Azure Artifact feed with an upstream source of https://registry.npmjs.org/.

Through this Azure Artifact feed, I can download the following npm package:

  • caniuse-lite@1.0.30001017

But I can't download the following version of the same package:

  • caniuse-lite@1.0.30001016

If I go direct to npm (not through the artifact feed) I can pull both versions as expected.

Is there anyway to diagnose this issue further?

3 Answers

Not really sure as to why the issue happened... but I was able to solve it in my case by following these steps:

  1. Navigate to "Artifacts" within Azure
  2. Select your private NPM feed in the dropdown
  3. Click on "recycle bin" at the top of the screen
  4. Find the package which you're having trouble with
  5. Click restore on the package version

The download package version is driven by the one specifying the versions in the package.json. So what you could do is simply modify the package.json and run a npm install then. Be sure to clear out the node_modules directory before you do that. Then we could specific npm package version to download in the Azure DevOps pipeline. Please check this doc for more details.

Also, we could run npm install <package>@<version> to install an older version of a package. We could add the --save flag to that command to add it to your package.json dependencies, or --save --save-exact flags if you want that exact version specified in your package.json dependencies.

Not sure the setup you have but I had an issue where specific package where not being found and therefore couldn't be used.

Our Artifact was setup to get upstream feeds if local feed doesn't have the package. So it was odd why it wasn't getting from the upstream feed. Our Artifact feed was on a separate common project. Other projects are grabbing packages from the common project.

It turned out that the problem was the permissions setup from the other projects to the common project. It was Reader role only. This was fine for packages that were already stored in the local Artifact feed but when it couldn't find one and went to get it from the upstream feed, it needed write permissions to write it to the local feed.

Related