NPM packages not being downloaded from upstream source

Apologies, not sure if this is the right place to ask this..

We have a private project scoped feed in Azure devops to which we have deployed a React component library.

We make use of this component library in another project. As part of the build stage of this project in Azure Devops, we run npm install. Authentication between this project and the feed where the component library is to be found has been configured fine and works with no issue.

We've been noticing an issue related to the retention of NPM packages that have been downloaded from an upstream source (the public NPM registry). In the feed settings, note that package retention has been enabled and the settings for max versions per package is set to 20, with days to keep recent packages set to 30.

Problem 1: The npm install step errors saying a particular version of a package cannot be found in the registry. On investigation, we find that the version mentioned has been moved into the recycle bin, presumably as an effect of the retention policy. To overcome this issue, we do a manual restore, per a suggestion found on SO (https://stackoverflow.com/a/67421387/2389962), to bring that version back and our install step subsequently works.

Problem 2: Npm install reports the same error as above. However, this time the package version mentioned cannot be found in the list of cached packages nor in the recycle bin. We are stuck on how to resolve this.

Question 1: how can we overcome problem 2.

Question 2: why do either of the above problems occur. Should it not be a case of if a particular requested package version is not in our devops feed, that it goes and grabs a fresh copy from the upstream source. This seems like a bug that it does not do that?

Thanks

microsoft / azuredevopslabs

NPM packages not being downloaded from upstream source #613