yarnpkg/yarn

Private npm registry authentication issue on yarn.lock and package.json semver mismatch

Open

#5,256 opened on Jan 20, 2018

View on GitHub
 (3 comments) (0 reactions) (1 assignee)JavaScript (2,731 forks)batch import
good first issuehelp wantedtriaged

Repository metrics

Stars
 (41,514 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Do you want to request a feature or report a bug? BUG

What is the current behavior? Yarn does not authenticate with the private npm registry when the package.json and yarn.lock have a semver mismatch for a spesific package.

For example: yarn add css-hot-loader edit package.json and remove the carrot (^) from the version yarn install Result: Rejected 401, Unauthenticated

OS: Linux, Ubuntu (Heroku)

Contributor guide

Research direction
Investigate how Yarn authenticates requests to private npm registries, particularly when resolving packages from yarn.lock vs package.json. Focus on the code path that handles registry authentication and identify where semver mismatch causes the authentication header to be omitted.
Tech stack
javascriptnodejs
Domain
cli
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitNode.js
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60