[Question] Response timeouts for packages

[bozdoz]

I saw as of npm-registry-fetch@4.0.3 that the default timeout for requests is 30s (npm/cli@ea0ff56)

I think that should be fine.

I'm curious about the endpoints that are being requested using npm ci for example.

My understanding is that the package-lock.json file should already have a "resolved" tarfile, and should just download that:

    "typescript": {
      "version": "4.2.4",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.2.4.tgz",
      "integrity": "sha512-V+evlYHZnQkaz8TRBuxTA92yZBPotr5H+WhQ7bD3hZUndx5tGOa1fuCgeSjxAzM1RiN5IzvadIXTVefuuwZCRg==",
      "dev": true
    }

But (given my network situation) this request can timeout; not because it's requesting the .tgz file, but because it's requesting https://registry.npmjs.org/typescript (which appears to be just a JSON list of versions?)

Why is this happening, if there is a resolved tarfile, and how could I prevent this/improve the performance of my installs?

[MylesBorins]

hey @bozdoz I've pinged @npm/cli to help answer this

[bozdoz]

Any idea how likely this is to be answered?

[bozdoz]

Oh well

[bozdoz]

Going to answer my own question. I eventually figured this out by adding DEBUG=*, and a few other flags, and then looking into the files in the stack trace when the request times out.

What is happening?

It's fetching a "packument"

Packument objects are general metadata about a project corresponding to registry metadata, and include version and dist-tag information about a package's available versions, rather than a specific version.

Why is this happening?

Yes, there is a resolved tarfile; however, the "packument" will be fetched if the resolved value's registry url is not identical:

https://github.com/npm/pacote/blob/v9.5.12/lib/fetchers/registry/tarball.js#L18-L22

if (
  opts.resolved &&
  // spec.type === 'version' &&
  opts.resolved.indexOf(registry) === 0
) {
// ...
}

In my case, with a private registry, there was a discrepancy between the registry urls.

My .npmrc:

registry=https://artifactory.example.com/artifactory/npm/npm/

A sample "resolved" field:

{
    "typescript": {
      "resolved": "https://artifactory.example.com:443/artifactory/npm/npm/typescript/-/typescript-4.2.4.tgz"
    }
}

This caused the "packument" to be fetched, which is huge, and caused the timeouts.

How can I prevent this?

Change the registry in .npmrc to reflect the registry which is being resolved in the lockfile.

Thanks!