publish failed by authorization coz different npm-registry-fetch version

What am I facing

In a word: I use lerna to publish packages, but failed by authorization.

Root Cause

Here are dependencies:

lerna@^4.0.0
   ┗━━ @lerna/publish@^4.0.0
          ┣━━npm-registry-fetch@^9.0.0
          ┗━━@lerna/npm-publish@^4.0.0
                ┗━━libnpmpublish@^4.0.0
                       ┗━━npm-registry-fetch@^10.0.0

lerna publishes package chain: @lerna/publish -> @lerna/npm-publish -> libnpmpublish In fact, yarn installed libnpmpublish@4.0.1 coz ^4.0.0, it make sense. So I have two version npm-registry-fetch,

@lerna/publish build opts via npm-registry-fetch@^9.0.0 and libnpmpublish@4.0.1 get auth failed from opts via npm-registry-fetch@^10.0.0

Finally, I got error: lerna ERR! E401 Unable to authenticate, need: BASIC realm="Sonatype Nexus Repository Manager"

Workaround

add this to package.json

{
  "resolutions": {
    "libnpmpublish": "4.0.0"
  },
}

I have reported this to libnpmpublish. #21

On lerna side, do we consider upgrade npm-registry-fetch to 10.0.0?

[sidd]

This issue was very helpful in tracking down the problem in our codebase, which relies on NXRM 2. Just wanted to share another workaround that does not depend on Yarn resolutions:

Our .npmrc contained a line that uses _auth, which appears to be ignored by npm-registry-fetch. This function only reads auth fields from lines that follow the format (see function here):

//my.registry-domain.com/:_auth=<my_token_here>

So if your full Nexus npm URL was http://localhost:8081/nexus/content/repositories/npm-internal/

Your npmrc should contain a line that looks something like:

//localhost:8081/:_auth=dXNlcm5hbWU6cGFzc3dvcmQ=

[gaokun]

@dptoot Yes, upgraded npm-registry-fetch with major version, but published libnpmpublish as patch version. (0_0)