package-lock.json resolved link points to local artifactory URL instead of globally set registry

Question

I have a .npmrc file with:

registy=http://artifacts.sample.com/artifactory/api/npm/

package-lock.json contains resolved field for dependencies which looks something like:

"dependencies": {
    "acorn": {
      "version": "5.7.3",
      "resolved": "http://artifacts.sample.com/artifactory/api/npm/acorn/-/acorn-5.7.3.tgz",
      "integrity": "sha512-T/zvzYRfbVojPWahDsE5evJdHb3oJoQfFbsrKM7w5Zcs++Tr257tia3BmMP8XYVjp1S9RZXQMh7gao96BlqZOw==",
      "dev": true
    }

Now, when I do npm install, it changes the package-lock.json resolved field to point to a local artifactory instead of the one specified in .npmrc like:

"dependencies": {
    "acorn": {
      "version": "5.7.3",
      "resolved": "http://localrepo.sample.com/artifactory/api/npm/acorn/-/acorn-5.7.3.tgz",
      "integrity": "sha512-T/zvzYRfbVojPWahDsE5evJdHb3oJoQfFbsrKM7w5Zcs++Tr257tia3BmMP8XYVjp1S9RZXQMh7gao96BlqZOw==",
      "dev": true
    }

We have localized code and this will give access denied to someone living on the other side of the world, where their artifacts URL points somewhere else, or it will just change the package-lock.json file for them to point to their local URL instead, and we will always have changing package-lock.json file.

I had issues with "dev" and "integrity" too, but they were fixed using https://github.com/npm/npm/issues/16938#issuecomment-339863980

I'm on the latest versions of node and npm.

node -v
v10.15.3

npm -v
6.9.0

Is there anyway we can avoid this?

score 1 · Answer 1 · answered Mar 05 '20 at 03:11

From my own experience. If you have setup default registry, the "resolved" field in package-lock.json will have no effect. I just followed Artifactory npm registry official doc.

npm config set registry https://artifactory.my.com/artifactory/api/npm/npm-repo/
npm login
npm config set //artifactory.my.com/artifactory/api/npm/npm-repo/:always-auth=true

Alternatively, a simple trick is to update the host file (eg. /etc/hosts) to ensure the "resolved" field url is never reachable, this will help you to observe npm behaviour.

package-lock.json resolved link points to local artifactory URL instead of globally set registry

1 Answers1