uplink not working for transitive dependency

[haquezameer]

I have the following config:

# path to a directory with all packages
storage: ./storage

uplinks:
  github:
    url: https://npm.pkg.github.com/
    auth:
      type: bearer
      token_env: TOKEN

# configure package config
packages:
  "@scope/package1":
    # scoped packages
    access: $all
    proxy: github

  "@scope/package2":
    # scoped packages
    access: $all
    publish: $all
    unpublish: $all

I use verdaccio for my E2E tests. I set @scope:registry to localhost(where verdaccio server is running).

In my app I use package from @scope/package1 which depends on a version 1.7.0 of @scope/package2. All current versions of @scope/package2 are available in the locally running verdaccio registry when tests are run, and @scope/package1 and its dependencies are supposed to be downloaded from uplink as configured in the above snipped.
For our case, lets say the current version available for @scope/package2 in the locally running verdaccio registry is 1.8.0. Due to this when tests are run and @scope/package1 looks for @scope/package2 version 1.7.0 in the locally running verdaccio instance, its not able to find it and tests fail.

My concern is why does @scope/pacakge1 looks for @scope/package2 version 1.7.0 in the local running instance and not go to the github uplink? The @scope/package1 package is itself being installed from the uplink, then why are its dependencies also not installed from the uplink?

TLDR:
App depends on @scope/package1 and @scope/package2. @scope/package1 also depends on @scope/package2. @scope/package2 is stored in locally running registry but only the current version. Uplink is configured for @scope/package1 as its never available in the locally running registry. When a request to install pacakge1 is made, it tries in localhost and then goes to uplink. Now, since package1 is being downloaded from the uplink, I want its dependencies also to be installed from uplink and not looked for in the locally running instance.

Is it possible?

[haquezameer]

@juanpicado any thoughts on this?

[juanpicado]

Thanks for the reminder, :) I'll take a look over the week (top 5 on my list).

[juanpicado]

The @scope/package1 package is itself being installed from the uplink, then why are its dependencies also not installed from the uplink?

As far I see you have defined scope package 2 to don't have proxy, so the registry won't look up there.

Each request is independent each other, in your local tree project the package manager might find 1,000 deps and will fetch each of them one by one so Verdaccio will resolving each of them matching your config, Verdaccio does not understand of transitive dependencies, it only reply each request accordingly.

[juanpicado]

My concern is why does @scope/pacakge1 looks for @scope/package2 version 1.7.0 in the local running instance and not go to the github uplink?

I would need to see what you have on the lock file and package.json, if the app looks for 1.7.0 then is the package manager who is asking for that specific version, not verdaccio.

[juanpicado]

, since package1 is being downloaded from the uplink, I want its dependencies also to be installed from uplink and not looked for in the locally running instance.

So, you want 1.8.0 being installed locally and 1.7.0 from the uplink, Have I understood this correctly?