npm doesn't support multiple registryUrls?

[mikethecalamity]

What would you like help with?

I think I found a bug

How are you running Renovate?

None

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab

Please tell us more about your question or problem

I have multiple private repositories that my dependencies come from aside from the usual. So I setup a packageRules with multiple options to find the dependencies. The maven datasources work as expected, each registry listed is checked. But for npm datasources there is an error: Excess registryUrls found for datasource lookup - using first configured only. So only the first registry is checked.

Config:

packageRules: [
    {
      matchDatasources: ['maven'],
      registryUrls: [
        "https://repo.maven.apache.org/maven2",
        "https://plugins.gradle.org/m2",
        "https://my.registry1.com/m2",
        "https://my.registry2.com/m2"
      ]
    },
    {
      matchDatasources: ['npm'],
      registryUrls: [
        "https://registry.npmjs.org",
        "https://my.registry1.com/npm",
        "https://my.registry2.com/npm"
      ]
    }
]

Logs (if relevant)

{
    "name": "renovate",
    "hostname": "runner-dhpshxtr-project-77108-concurrent-0",
    "pid": 20,
    "level": 40,
    "logContext": "q-G0EPk8A93XteAtxv1Kl",
    "repository": "my/repository",
    "datasource": "npm",
    "packageName": "@project/my-package",
    "registryUrls": [
        "https://registry.npmjs.org",
        "https://my.registry1.com/npm",
        "https://my.registry2.com/npm"
    ],
    "msg": "Excess registryUrls found for datasource lookup - using first configured only",
    "time": "2024-05-03T04:31:16.618Z",
    "v": 0
}

[mikethecalamity]

I pulled the down the renovate source and noticed the registryStrategy property. I would like to use the hunt mode for my registries. How can I set this in my config? I don't see it in the configuration documentation.

[rarkins]

npm itself doesn't allow multiple default registries in npmrc. You need to configure one or more scopes per non-default registry.

[mikethecalamity]

But when I specify packageRules with registryUrls for npm, based on the logs, it's no longer taking my npmrc into consideration (which I know because there's a completely different registry in the npmrc that is no longer referenced in the logs). Therefore, when packageRules contains registryUrls, the registryStrategy should be able to be overriden.

[rarkins]

No, we choose to behave the same way npm does. There's no point in our lookup hunting and succeeding if "npm install" subsequently fails to update the lock file.

[rarkins]

If packageRules are confusing you then you can instead configure an npmrc string. There you can have only one default and rest must use scopes

[mikethecalamity]

I setup the maven datasource first, which did allow multiple registries. So I think I was just surprised at how differently npm is.

I found the documentation for the npmrc property to override it. That might work for what I need. Thanks.

[rarkins]

Generally we map our datasources to the way the corresponding package manager behaves. npm does not have the concept of default fallback registries