`deprecated` field in package.json causes all old packages to be deleted at the time of publish

Describe the bug

If package.json in the project has a "deprecated" field, other versions of the package will be lost during publish.

To Reproduce

• add "deprecated": "message" in package.json
• bump version
• npm publish --registry localhost:4873

All the old packages are lost.

Expected behavior

At registry.npmjs.org:

• "deprecated": false will do nothing
• "deprecated": "message" will deprecate the current package (won’t delete older packages)

Screenshots

Configuration File (cat ~/.config/verdaccio/config.yaml)

Environment information

master branch of this repo

Debugging output

• $ NODE_DEBUG=request verdaccio display request calls (verdaccio <–> uplinks)
• $ DEBUG=express:* verdaccio enable extreme verdaccio debug mode (verdaccio api)
• $ npm -ddd prints:

npm info using npm@6.14.8 npm info using node@v12.19.0

• $ npm config get registry prints:

[mciocan]

Hello @juanpicado,

We have the same problem. Our setup is:

node: 14.18.0
npm: 6.14.5
verdaccio docker: 5.1.6

How to reproduce:

1. Start verdaccio container

docker run -it --rm --name verdaccio -p 4873:4873 verdaccio/verdaccio:5.1.6

1. NPM login

npm login

1. Publish a package without deprecated field in package.json

{
  "name": "npm-package-deprecated",
  "version": "1.0.0",
  "main": "index.js",
  "license": "ISC"
}

1. Repeat the operation a few times, for package history puposes

npm publish
npm version patch -m "chore: version %s"

1. Check package

npm view npm-package-deprecated

npm-package-deprecated@1.0.3 | ISC | deps: none | versions: 4

dist
.tarball: http://0.0.0.0:4873/npm-package-deprecated/-/npm-package-deprecated-1.0.3.tgz
.shasum: df605bb584c40eaaaace4f04b138dc9fcb0a3ddb
.integrity: sha512-A3CVuTqJTA/N6NzXfa1YStGZyq2tOVkye/muLJfAMhkwmsnP7v0MIe3rG18uXR/kjQ+dzOgKQFQpuhTKAtC20g==

dist-tags:
latest: 1.0.3  

published a minute ago

npm view npm-package-deprecated versions

[ '1.0.0', '1.0.1', '1.0.2', '1.0.3' ]

1. Add deprecated field in package.json and publish

{
  "name": "npm-package-deprecated",
  "deprecated": false,
  "version": "1.0.4",
  "main": "index.js",
  "license": "ISC"
}

1. All previous versions are unpublished (verdaccio docker logs)

info --- unpublishing npm-package-deprecated@1.0.0
info --- unpublishing npm-package-deprecated@1.0.1
info --- unpublishing npm-package-deprecated@1.0.2
info --- unpublishing npm-package-deprecated@1.0.3
http --- 201, user: test(172.17.0.1), req: 'PUT /npm-package-deprecated', bytes: 1094/49

1. Check package again

npm view npm-package-deprecated versions

[ '1.0.4' ]

npm view npm-package-deprecated

npm-package-deprecated@1.0.4 | ISC | deps: none | versions: 1

dist
.tarball: http://0.0.0.0:4873/npm-package-deprecated/-/npm-package-deprecated-1.0.4.tgz
.shasum: 9922075fd3af49663a606e50fd75d9fa171e7092
.integrity: sha512-32i0WQ0u7U4VPa+IeqamQGwTiOM0/NiI4vf0/dnoYRRUuX8+ec9kFc/t/MKkxLcAQyBOQcP2zNo32/8JHZCnkQ==

dist-tags:
latest: 1.0.4  

published just now

If there is any other info I can provide, please let me know! Thank you!

PS: a big thank you also for verdaccio 💯

[juanpicado]

Fixed on https://github.com/verdaccio/verdaccio/releases/tag/v5.3.2