WARN: artifactErrors .version is quarantined so .time exists but .version is missing

[SteveBrown-Sonatype]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitHub?

Please tell us more about your question or problem

Hey all,

Really quick one 'hopefully', probably doesn't need to go into great detail, basically as per the title, an associate reports that their pipeline breaks when .time and .version does not match, if they run it against a public repo it works fine (which is expected), but some of the versions have been quarantined by one of our tools since they have vulnerabilities (as per NPM specification) so .time exists and .version does not, the error from Renovate is as follows:

`WARN: artifactErrors (repository=Backstage/EngineersHub, baseBranch=main, branch=renovate/zod-to-json-schema-3.x)

"artifactErrors": [

{

"lockFile": "yarn.lock",

"stderr": "➤ YN0000: · Yarn 4.1.1\n➤ YN0000: ┌ Resolution step\n➤ YN0082: │ zod-to-json-schema@npm:3.23.0: No candidates found\n➤ YN0000: └ Completed in 3s 937ms\n➤ YN0000: · Failed with errors in 3s 956ms\n"

}

]`

Any idea if there is a configuration option or workaround available? Any comments or info would be greatly appreciated,

Many thanks,

Steve B

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[rarkins]

This error comes from yarn and not directly from Renovate. You need to give more details about how this scenario happens, for example is this a PR upgrading zod-to-json-schema to 3.23.0?

[SteveBrown-Sonatype]

Heya, thanks for the quick response, unfortunately I don't have this info handy over the weekend and yes indeed it is yarn, so perhaps not actually renovate specific

It is possible to reproduce as follows and apologies I haven't drilled into this at any great length:

Reproduce command: yarn npm info --json @backstage/plugin-catalog-backend-module-incremental-ingestion

Reproduce steps:

using endpoint https://repo.nexuscloud.company.cloud/repository/npmjs-org/ (Nexus3) - file: npmjs-org-via-nexus.json (attached): “0.0.0-nightly-20240503021457” is not in .version key, but is in .time key. == NOT WORKING

using endpoint https://registry.npmjs.org/ - file: npmjs-org-direct.json (attached): we see “0.0.0-nightly-20240503021457” is both in .version key AND .time key. == CORRECTLY WORKING

[SteveBrown-Sonatype]

Just for completeness, apologies didn't attach the .json outputs, but here are the extracts

`Failing:

yarn npm info --json @backstage/plugin-catalog-backend-module-incremental-ingestion

"description": "An entity provider for streaming large asset sources into the catalog",
"repository": {
"type": "git",
"url": "https://github.com/backstage/backstage",
"directory": "plugins/catalog-backend-module-incremental-ingestion"
},
"license": "Apache-2.0",
"versions": [

<< REMOVED >>

Does not exist..

"name": "@backstage/plugin-catalog-backend-module-incremental-ingestion",
"time": {

<< REMOVED >>

"0.0.0-nightly-20240503021457": "2024-05-03T02:26:27.593Z"

},

Exists..

Working:

yarn npm info --json @backstage/plugin-catalog-backend-module-incremental-ingestion

{
"name": "@backstage/plugin-catalog-backend-module-incremental-ingestion",
"dist-tags": {
"nightly": "0.0.0-nightly-20240503021457",
"latest": "0.4.22",
"next": "0.4.23-next.1"
},

"versions": [

<< REMOVED >>

"0.0.0-nightly-20240503021457",

Exists..

"time": {

  "0.0.0-nightly-20240503021457": "2024-05-03T02:26:27.593Z"

},

Exists..`

[github-actions[bot]]

Hi, please format any copy/pasted code or logs so they're readable.

You can find a Markdown code formatting guide here as well as some GitHub-specific information formatting code blocks here.

Thanks, the Renovate team

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

Read the Renovate docs, troubleshooting, self-hosted to learn how to find the logs.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[rarkins]

Ultimately, yarn is reporting back "I can't build this dependency tree". Renovate itself is not erroring directly. I'm not sure it's possible to tell from the logs you provided already exactly why. It may have nothing to do with time existing but version being present. Instead there may be a package which depends on the exact version you removed from your registry, so it fails.

Debug logs from a run will be necessary to form any more specific opinions

[SteveBrown-Sonatype]

Hi rarkins,

many thanks for the info, we are going to park this here, we are still unravelling this one on our side, we will get back to you if there is anything new, specific to renovate,