{"action":"created","issue":{"url":"https://api.github.com/repos/verdaccio/verdaccio/issues/34","repository_url":"https://api.github.com/repos/verdaccio/verdaccio","labels_url":"https://api.github.com/repos/verdaccio/verdaccio/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/verdaccio/verdaccio/issues/34/comments","events_url":"https://api.github.com/repos/verdaccio/verdaccio/issues/34/events","html_url":"https://github.com/verdaccio/verdaccio/issues/34","id":155507491,"number":34,"title":"Not everything may be being cached","user":{"login":"steve-p-com","id":5180548,"avatar_url":"https://avatars.githubusercontent.com/u/5180548?v=3","gravatar_id":"","url":"https://api.github.com/users/steve-p-com","html_url":"https://github.com/steve-p-com","followers_url":"https://api.github.com/users/steve-p-com/followers","following_url":"https://api.github.com/users/steve-p-com/following{/other_user}","gists_url":"https://api.github.com/users/steve-p-com/gists{/gist_id}","starred_url":"https://api.github.com/users/steve-p-com/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/steve-p-com/subscriptions","organizations_url":"https://api.github.com/users/steve-p-com/orgs","repos_url":"https://api.github.com/users/steve-p-com/repos","events_url":"https://api.github.com/users/steve-p-com/events{/privacy}","received_events_url":"https://api.github.com/users/steve-p-com/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-05-18T13:54:53Z","updated_at":"2016-12-29T10:07:30Z","closed_at":null,"body":"I've noticed recently that I am seeing lines in my `npm-shrinkwrap.json` files which indicate a few packages are still being installed from `registry.npmjs.org` instead of  `verdaccio`. For example:\n\n```\n\"iconv-lite\": {\n   \"version\": \"0.4.13\",\n   \"from\": \"iconv-lite@0.4.13\",\n   \"resolved\": \"https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.13.tgz\"\n },\n```\n\nIt seems to be some (but not all) indirect dependencies. I have not had time to investigate this further yet, but clearly it's unexpected behaviour to not be using the cache.\n\nThe effect is fairly minimal if `npm`can see the `registry.npmjs.org` server. It just causes extra Internet traffic because some some packages are fetched from that registry. If the server is locked down so that it can't see the external registry, then it breaks the install process.\n\nI think something changed quite recently, and the most likely culprit is moving to npm 3 on our development machines (where the shrinkwrap files are created). When you create a shrinkwrap file I believe it uses a combination of the `npm` cache and the `node_modules` folder to generate the metadata for each dependency in the tree. I am guessing that something has changed here, and not necessarily for the better.\n\nI will investigate further when I have time. For now, the workaround is simply to edit `npm-shrinkwrap.json` after creating it, replacing any `registry.npmjs.org` references with the correct `verdaccio`registry. This seems to work fine.\n"},"comment":{"url":"https://api.github.com/repos/verdaccio/verdaccio/issues/comments/269608059","html_url":"https://github.com/verdaccio/verdaccio/issues/34#issuecomment-269608059","issue_url":"https://api.github.com/repos/verdaccio/verdaccio/issues/34","id":269608059,"user":{"login":"mhverbakel","id":11353785,"avatar_url":"https://avatars.githubusercontent.com/u/11353785?v=3","gravatar_id":"","url":"https://api.github.com/users/mhverbakel","html_url":"https://github.com/mhverbakel","followers_url":"https://api.github.com/users/mhverbakel/followers","following_url":"https://api.github.com/users/mhverbakel/following{/other_user}","gists_url":"https://api.github.com/users/mhverbakel/gists{/gist_id}","starred_url":"https://api.github.com/users/mhverbakel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhverbakel/subscriptions","organizations_url":"https://api.github.com/users/mhverbakel/orgs","repos_url":"https://api.github.com/users/mhverbakel/repos","events_url":"https://api.github.com/users/mhverbakel/events{/privacy}","received_events_url":"https://api.github.com/users/mhverbakel/received_events","type":"User","site_admin":false},"created_at":"2016-12-29T10:07:30Z","updated_at":"2016-12-29T10:07:30Z","body":"I think I found the cause of this problem, or actually two of them.\r\n\r\n1. When a package that you install is still in your cache, downloaded directly (not through the cache), it will show up in the shrinkwrap as resolved from the npmjs server (which is true). This should not be resolved by verdaccio, as it is a user fault.\r\n2. If a package contains a `npm-shrinkwrap.json` file, it will contain direct urls to the original repository. In my opinion, verdaccio should scan the packages for these files, and update the `resolved` tags there if that url points to the upstream repository."}}
{"actor":{"display_login":"mhverbakel"}}