Hello,
we tried overwriting (simply via npm publish) some npm packages after removing the publishConfig entries from their package/package.json files (because they pointed to our older repository server, which caused some issues) as well as removing the package/npm-shrinkwrap.json (which also caused some issues).
The repository had (temporarily) enabled redeploy so the overwrite succeeded and now there are new packages copies available.
However when looking at the JSON package listing at the repository// endpoint, we can still see some old metadata (from the previous copies of the overwritten packages), for example the mentioned publishConfig which should be now gone, or _shasum (while the dist.shasum is correct).
And even though we tried to rebuild all the metadata via the appropriate server tasks, it didn’t make any difference.
I tried to search for the place where this data might be stored but haven’t been successful so far. It isn’t in the OrientDB component database and I found only the generated output JSONs (that the server returns to the above mentioned request) in the blob store - so these don’t appear to be the source of these data.
Where do these data still come from? How to force their full rebuild on package overwrite?
Notes:
- These metadata (that don’t update with the package overwrite) could be generated by some of the previous Nexus 3 versions (that we were running there in the past). They may even come from Nexus 2 from which we originally created this repository via migration (at least in some cases they almost certainly do).
- We tried to delete & publish again some of the affected packages which helped (after performing the npm metadata rebuild), but that shouldn’t be necessary (and it’s too late to do it now once they’ve all been already replaced).
Nexus 3.43.0