NPM锁文件/shrapwrap随机获得"dl".附加到“已解决"参数上的参数.网址 [英] NPM lockfiles/shrinkwrap get random "dl" parameter tacked on to the "resolved" URL

问题描述

我们公司使用Artifactory信息库来存储内部发布的软件包，并作为NPM注册中心的代理.有时，lockfiles/shrinkwrap文件中的resolved字段符合预期，包含我们内部存储库的URL，但有时它们以如下形式显示(为清楚起见添加了换行符):

Our company uses an Artifactory repository for storing internally-published packages and as a proxy for the NPM registry. Sometimes the resolved field in lockfiles/shrinkwrap files is as expected, containing URLs for our internal repository, but occasionally they show up as something like this (line break added for clarity):

https://our.repository.com/artifactory/api/npm/some-repo/lodash/-/lodash-3.10.1.tgz
  ?dl=https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

然后，从拉取请求到拉取请求，这些dl参数不断波动，以根据哪个开发人员执行npm install来出现或删除，从而导致很多拉取请求&发出噪音.

Then, from pull request to pull requests, these dl parameters constantly oscillate to being present or removed depending on which developer does an npm install, leading to a lot of pull request & commit noise.

我猜测是Artifactory在添加此dl参数，因为在npm代码库的代码搜索中看不到它.

I'm guessing it's Artifactory that's adding this dl param, since I fail to see it in a code search in the npm code base.

为什么会这样?我们可以禁用此行为吗?是否可以安全地将此参数作为postshrinkwrap脚本变通办法来解决?

Why does this happen? Can we disable this behavior? And is it safe to strip this parameter as a postshrinkwrap script workaround?

推荐答案

我认为问题的根源可能是缓存.

I think the root of your problem is likely caching.

NPM缓存已下载的程序包，因此不必再次下载它们，如有必要，它们甚至可以脱机重新安装.它还缓存解析后的值以供以后使用.如果已经解析并下载了相同版本的软件包，则无需再次获取它并获取更新的下载/解析URL.

NPM caches packages that have been downloaded, so they don't have to be downloaded again, and they can even be re-installed offline if necessary. It also caches the resolved value for later use. If a package of the same version has already been resolved and downloaded, it doesn't need to go and fetch it again and get the updated download/resolved URL.

您可以使用以下命令手动清除此缓存.

You can manually clear this cache with the following command.

npm cache clean --force

或者，也可能是由于NPM的不同版本计算解析字段的方式不同(是否遵循Location标头).但是，我认为更可能归咎于缓存.

Alternately, it could be that difference in how different versions of NPM calculate the resolved field are to blame (following the Location header or not). However I think caching is more-likely to blame.

这篇关于NPM锁文件/shrapwrap随机获得"dl".附加到“已解决"参数上的参数.网址的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！