Open drik98 opened 1 month ago
Note: I am using dependabot on gitlab through dependabot-gitlab in the standalone version which uses dependabot-core. I created an issue there but was pointed here as the logic regarding fetching the dependencies using the configured registries comes from the dependabot-core.
I'm seeing this issue as well - on GitHub, not GitLab - and it causes my Dependabot jobs to time out 100% of the time because I have a lot of dependencies and it's erroneously searching for them on GitHub Packages when it should be searching for them on npmjs.org.
I'm seeing this issue as well - on GitHub, not GitLab - and it causes my Dependabot jobs to time out 100% of the time because I have a lot of dependencies and it's erroneously searching for them on GitHub Packages when it should be searching for them on npmjs.org.
„Great“ to hear that this is not a gitlab only issue. Are you able to create a github only repro?
Is there an existing issue for this?
Package ecosystem
npm
Package manager version
pnpm@8.15.1
Language version
node v20.12.2
Manifest location and content before the Dependabot update
/package.json /pnpm-lock.yaml
dependabot.yml content
.npmrc:
Updated dependency
An internal one from the self hosted nexus.
What you expected to see, versus what you actually saw
Given that I have not set
replaces-base
on the configured registrynpm-private
totrue
and also only set the scoped registry (@internal:registry=...
) and notregistry=...
in the.npmrc
file I would expect that while the updated internal dependency is pulled from the self hosted nexus all other (public) packages are pulled from the official npm registry (https://registry.npmjs.org). Instead I can observe with debug log enabled that all packages are pulled from the internal nexus (see logs for more details):flag_vi:This results (I think) in a really slow execution of the version update (up to 10 minutes per updated dependency/creating the Merge request). This sometimes causes builds to timeout and also results in a lot of used build minutes.
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
Log output
Smallest manifest that reproduces the issue
No response