feat: deprecation

Goals

accept

npm deprecate <pkg>[@<versionOrRange>] <message>
yarn deprecate <pkg>[@<versionOrRange>] <message>

as i need to reverse engineer that for yarn anyway i can integrate it here fast also.

TODO

offer the same api as npm does and add “deprecated”: “msg” filds to the manifest on download

• https://github.com/verdaccio/verdaccio/blob/master/src/api/endpoint/api/publish.ts#L98
  • Will need to check if the puted data is a deprecate reqest some how need examin headers.
  • its a Put request to the HTML escaped version of spec.name npmjs.org/spec.escapedName
  • needs semver checks for the supplyed version range exprensiv operation
  • need to check how the version range get suppyled by npm
  • integrate https://github.com/npm/npm-pick-manifest

DONE

Related Yarn issue

• https://github.com/yarnpkg/yarn/issues/4943

Current Development Branch

• https://github.com/direktspeed/verdaccio/tree/feat-deprecate

Current Ui Implamentation

• https://github.com/verdaccio/ui/issues/67

Blocking needs Discussion Questions that are importent

Feature Design Considerations some stuff needs to get splitted up in own issues as they are global questions. will prepare more detailed Issues.

The Main Problem that comes up is!

Befor this implamentation we could assume that data will not change npmjs.org will be consistent package meta don’t changes.

After this implamentation we deal with the fact that the deprecation status can change after we have fetched a copy of the package.

• We need to implament some form of last checked State from the upstream
  • some kind of extra fild lastChecked its not allowed to get added to the package.info
• We need to handle user Permissions will it be possible to deprecate packages that you don’t manage for example in a use case where a user installs this as proxy and don’t registers users he will fetch packages that he could deprecate some how?
• Should this inhire pull the NPM Or Upstream Registry deprecation meta infos
• Schould this also run deprecate against the upstream Registrys?
• When a NPM Package is not deprecated but we have a deprecated version?
• When a NPM Package is deprecated but we have a none deprecated version?
• deprecation state needs sync with upstream registrys
• plugin authority-registry
  • Current Standard behavior ask upstream only if we don’t got infos
  • but stores indipenden deprecation messages.if present deprecation behavior needs to be set explizit if it should inhire from source registry or not
• plugin proxy-registry
  • if we know we run as a offline proxy
  • if we know we are a additional cache for npm

[DanielRuf]

Related: https://github.com/verdaccio/ui/issues/67

[juanpicado]

Closing in favor the relates one.

Thanks 😃