404 error running `yarn npm audit`

[rbirkgit]

Self-service

• I'd be willing to implement a fix

Describe the bug

Trying to run audit with "yarn npm audit" but get error. Running against the same private artifactory with classic yarn works fine.

To reproduce

Running "yarn npm audit" gives this error:

➤ YN0035: The remote server failed to provide the requested resource
➤ YN0035:   Response Code: 404 (Not Found)
➤ YN0035:   Request Method: POST
➤ YN0035:   Request URL: https://build-artifactory.eng.xxx.com/artifactory/api/npm/npm-local/-/npm/v1/security/audits/quick

➤ Errors happened when preparing the environment required to run this command.
➤ This might be caused by packages being missing from the lockfile, in which case running "yarn install" might help.

Opening the URL above directly in the browser returns this:

{
  "errors" : [ {
    "status" : 405,
    "message" : "Method Not Allowed"
  } ]
}

With yarn classic I can run "yarn audit" against same artifactory fine.

Environment

System:
    OS: Windows 10 10.0.22000
    CPU: (12) x64 Intel(R) Core(TM) i7-8850H CPU @ 2.60GHz
  Binaries:
    Node: 16.15.0 - ~\AppData\Local\Temp\xfs-7b47e6ea\node.CMD
    Yarn: 3.1.1 - ~\AppData\Local\Temp\xfs-7b47e6ea\yarn.CMD
    npm: 8.8.0 - C:\Program Files\nodejs\npm.CMD

Additional context

No response

[RDIL]

Looks like your remote artifactory instance doesn’t support the auditing URL - are you using multiple repositories?

[rbirkgit]

I'm confused. Why would yarn 1.x work and not yarn 3.x? Is the latter using a different URL to access the artifactory?

[rbirkgit]

Found out that I had this setting in my package.json file:

  "publishConfig": {
    "registry": "https://build-artifactory.eng.xxx.com/artifactory/api/npm/npm-local"
  },

Changing the url to just npm at the end fixed the issue (or removing this entry). Not sure why the audit command is using the package.json publishConfig setting to override default. But now I know what caused my issue.

[arcanis]

Not sure why the audit command is using the package.json publishConfig setting to override default.

Legacy. It's fixed in the next major: #4639

[nemonemi]

I am still experiencing the Bad request 400 with the yarn@3.4.1.