Repository: dependabot/dependabot-core

Issue #4669: Yarn.lock is updated with public registry instead of private one
Created: 2022-01-26T14:57:13Z
Package ecosystem
yarn
Package manager version
yarn 1.22.17
Language version
node 12.8.1
Manifest location and content prior to update
package.json
yarn.lock
dependabot.yml content
version: 2
registries:
  artifactory:
    type: npm-registry
    url: https://artifactory.XXX.com/artifactory/api/npm/XXX-npm/
    username: ${{secrets.ARTIFACTORY_USERNAME}}
    password: ${{secrets.ARTIFACTORY_PASSWORD}}
updates:
  - package-ecosystem: 'npm'
    registries:
      - artifactory
    directory: '/'
    schedule:
      interval: 'daily'

Updated dependency
https://github.com/websockets/ws from 6.2.1 to 6.2.2, but happen for other packages too.
What you expected to see, versus what you actually saw
yarn.lock changed from
resolved "https://artifactory.XXX.com:443/artifactory/api/npm/XXX-npm/ws/-/ws-6.2.1.tgz#442fdf0a47ed64f59b6a5d8ff130f4748ed524fb"

to
resolved "https://registry.yarnpkg.com/ws/-/ws-6.2.2.tgz#dd5cdbd57a9979916097652d78f1cc5faea0c32e"

I expect it to still use private registry.
Native package manager behavior
Updating package locally resolve to correct private registry. Locally I have .npmrc file that specify registry and credentials, this file is ignored by git so every collaborator can have their file in repo directory.
All logs referencing this package point to correct artifactory, but there are some logs referencing public one:
  proxy | 2022/01/26 12:18:28 [118] * authenticating npm registry request (host: artifactory.XXX.com, basic auth)
  proxy | 2022/01/26 12:18:28 [110] 200 https://artifactory.XXX.com:443/artifactory/api/npm/XXX-npm/callsites/-/callsites-0.2.0.tgz
  proxy | 2022/01/26 12:18:28 [120] GET https://registry.yarnpkg.com:443/sass/-/sass-1.49.0.tgz
  proxy | 2022/01/26 12:18:28 [122] GET https://registry.yarnpkg.com:443/chokidar/-/chokidar-3.5.3.tgz
  proxy | 2022/01/26 12:18:28 [112] 200 https://artifactory.XXX.com:443/artifactory/api/npm/XXX-npm/type/-/type-2.0.0.tgz
  proxy | 2022/01/26 12:18:28 [120] 200 https://registry.yarnpkg.com:443/sass/-/sass-1.49.0.tgz
  proxy | 2022/01/26 12:18:28 [122] 200 https://registry.yarnpkg.com:443/chokidar/-/chokidar-3.5.3.tgz

Duplicate issue #1937: [Yarn] Packages resolved from public registry rather than .npmrc registry in subdependency update 
Created: 2020-06-23T10:44:14Z
We have been using the dry-run script for updating dependencies for many azure based repos. Recently, we had come across an issue while updating subdependencies.
In case of subdependency update for yarn(>= 1.15.2) on an ubuntu container using dependabot-core, packages in yarn.lock are getting resolved by public registry(registry.yarnpkg) instead of the private registry mentioned in the .npmrc file. Currently we have the repo level .npmrc in this sample format:
registry=https://private_registry_url/npm/registry/
always-auth=true
package-lock=false
The user level .npmrc with auth token is in this format:
//private_registry_url/npm/registry/:username=office
//private_registry_url/npm/registry/:_password=[BASE64_ENCODED_PERSONAL_ACCESS_TOKEN]
//private_registry_url/npm/registry/:email=xyz@gmail.com
The repo does not have a .yarnrc file checked in. Could this issue be because of missing .yarnrc or is the authentication details in .npmrc not in correct format?

Closing comment (2022-09-17T10:32:03Z): Closing as a dupe of #4669