Npm scoped packages - String is not a valid semantic version error

Hi,

I've setup a connector to registry.npmjs.org but I am getting an error when installing scoped packages such as @angular/core. Other non-scoped packages are working fine. We are using version 4.5.3 of ProGet. I've attached a snippet from the npm-debug.log:

0 info it worked if it ends with ok
1 verbose cli [ 'C:\\Program Files\\nodejs\\node.exe',
1 verbose cli   'C:\\Users\\davidsimpson\\AppData\\Roaming\\npm\\node_modules\\npm\\bin\\npm-cli.js',
1 verbose cli   'install',
1 verbose cli   '--registry',
1 verbose cli   'http://cap-pkg.coretexa.local:8080/npm/C3-NPM' ]
2 info using npm@3.10.6
3 info using node@v6.7.0
4 silly loadCurrentTree Starting
5 silly install loadCurrentTree
6 silly install readLocalPackageData
7 silly install normalizeTree
8 silly loadCurrentTree Finishing
9 silly loadIdealTree Starting
10 silly install loadIdealTree
11 silly cloneCurrentTree Starting
12 silly install cloneCurrentTreeToIdealTree
13 silly cloneCurrentTree Finishing
14 silly loadShrinkwrap Starting
15 silly install loadShrinkwrap
16 silly loadShrinkwrap Finishing
17 silly loadAllDepsIntoIdealTree Starting
18 silly install loadAllDepsIntoIdealTree
19 silly fetchNamedPackageData @angular/core
20 silly mapToRegistry name @angular/core
21 silly mapToRegistry scope (from package name) @angular
22 verbose mapToRegistry no registry URL found in name for scope @angular
23 silly mapToRegistry using default registry
24 silly mapToRegistry registry http://cap-pkg.coretexa.local:8080/npm/C3-NPM
25 silly mapToRegistry data Result {
25 silly mapToRegistry   raw: '@angular/core',
25 silly mapToRegistry   scope: '@angular',
25 silly mapToRegistry   escapedName: '@angular%2fcore',
25 silly mapToRegistry   name: '@angular/core',
25 silly mapToRegistry   rawSpec: '',
25 silly mapToRegistry   spec: 'latest',
25 silly mapToRegistry   type: 'tag' }
26 silly mapToRegistry uri http://cap-pkg.coretexa.local:8080/npm/C3-NPM/@angular%2fcore
27 verbose request uri http://cap-pkg.coretexa.local:8080/npm/C3-NPM/@angular%2fcore
28 verbose request no auth needed
29 info attempt registry request try #1 at 3:28:39 PM
30 verbose request id 357a40e27039f945
31 http request GET http://cap-pkg.coretexa.local:8080/npm/C3-NPM/@angular%2fcore
32 http 500 http://cap-pkg.coretexa.local:8080/npm/C3-NPM/@angular%2fcore
33 verbose headers { 'cache-control': 'private',
33 verbose headers   'content-length': '80',
33 verbose headers   'content-type': 'application/json; charset=utf-8',
33 verbose headers   server: 'Microsoft-IIS/8.5',
33 verbose headers   'x-aspnet-version': '4.0.30319',
33 verbose headers   'x-powered-by': 'ASP.NET',
33 verbose headers   date: 'Tue, 15 Nov 2016 02:28:39 GMT' }
34 info retry will retry, error on last attempt: Error: ArgumentException String is not a valid semantic version.: npm

Product: ProGet
Version: 4.5.3

We can't reproduce this issue. Did this work before? If so, did any configuration change recently (new version of ProGet or npm, for example)?

No, we haven't had scoped npm packages working before. Un-scoped npm packages work fine though. We have been using ProGet Enterprise for about 6 months for nuget packages and only recently started using it for npm packages.

I'm seeing exactly the same problem as these two support questions:
http://inedo.com/support/questions/3696 and http://inedo.com/support/questions/4680

Those support questions say this issue was fixed in ProGet 4.0.11, however we've tried this on versions 4.5.2 and 4.5.3 and still get the same issue. We're using node 6.7.0 and npm 3.10.6 on the client side. We have ProGet hosted on IIS 8, Windows Server 2012 R2.

Just some further information on reproducing this. We are just using a simple package.json to test with a scoped package, e.g.

{
"version": "1.0.0",
"name": "proget.test",
"private": true,
"dependencies": {
"@angular/core": "^2.1.0"
}
}

And we are running the npm install command, pointing the registry to our ProGet server, e.g.
npm install --registry http://cap-pkg.coretexa.local:8080/npm/C3-NPM

When we switch the package.json to only include un-scoped packages then it works fine, e.g.

{
"version": "1.0.0",
"name": "proget.test",
"private": true,
"dependencies": {
"moment": "2.17.0"
}
}

This seems to indicate that the connector setup is working correctly and ProGet is only returning the "String is not a valid semantic version" error when retrieving scoped packages.

Were you able to get this working? I seem to get the same issue with ProGet 4.6.5 (and types/fs-extra package)

No, I haven't been able to get scoped packages working. I'm on 4.6.3 now and still having the same issue. I've had to put in a workaround to go directly against www.npmjs.com for all npm packages, which is a shame because we really want all types of packages to go through Proget. Inedo support, any idea on what is causing this?

We're still researching it; there were some changes in 4.6 to the HTTP Handling, but it seems to have some issues w/ some IIS configurations (or perhaps, libraries used by IIS? patch versions of .net? not sure yet)...

The underlying problem is the %2f as part of the path. This is simply not a common scenario, and is almost always accidental, which is why the underlying libraries (proxy servers sometimes, etc) automatically convert it to a "/" when passing it to the next thing in the pipeline.

Same problem here. We can't install any scoped package. Also when we open an deployed own scoped package, an unhandled error occurred:

Invalid npm package id.
with the following stacktrace:
[FormatException: Invalid npm package id.]
Inedo.ProGet.WebApplication.UnifiedFeedBrowsing.Feeds.NpmFeedDataFactory.ParsePackageIdentifier(String urlPackageVersionIdentifier) +518
Inedo.ProGet.WebApplication.Pages.Packages.PackageVersionPage.CreateChildControls() +173
Inedo.ProGet.WebApplication.Pages.<InitializeAsync>d__2.MoveNext() +281
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +144
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +84
Inedo.ProGet.WebApplication.Pages.Packages.<InitializeAsync>d__18.MoveNext() +950
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +144
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +84
Inedo.Web.PageFree.<ProcessRequestAsync>d__48.MoveNext() +380
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +144
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +84
System.Web.TaskAsyncHelper.EndTask(IAsyncResult ar) +98
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +606
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +288

It's very urgently needed to get this running;)

Unfortunately, at this point, we're unable to reproduce this at all, under any configurations of Windows. Upon installing a trace on the incoming requests to ProGet, the underlying problem is that the request being made to ProGet is incorrect, it has a / in the url instead of %2f.

So, we believe a proxy server or intermediate network appliance is replacing %2f with /. We have seen some reverse proxies do this already. It is highly unusual for a path to contain a %2f, so this is probably why such a problem/bug in the intermediate hardware would go unnoticed.

Hi Alana,

When you say "the request being made to ProGet is incorrect, it has a / in the url instead of %2f", we have tried making direct requests to ProGet using Postman with both escaped and non-escaped paths and we still get the same error, i.e:

http://cap-pkg.coretexa.local:8080/npm/C3-NPM/@angular%2Fcore
http://cap-pkg.coretexa.local:8080/npm/C3-NPM/@angular/core

both produce the "String is not a valid semantic version" error.

We don't get the error when we try the same thing using a non-scoped npm package path, i.e.

http://cap-pkg.coretexa.local:8080/npm/C3-NPM/moment

Also, when you say "it is highly unusual for a path to contain a %2f", every npm scoped package will contain this as that is the format for a scoped package.
https://docs.npmjs.com/getting-started/scoped-packages

Scoped npm packages are becoming increasingly more common so it would be great to have a solution to this.

Regards,
David

Hi,

our case is fixed by adding the following configuration to the Web.config

<add key="aspnet:UseLegacyRequestUrlGeneration" value="true" />
Problem was the decoded @ in the url from the schöpfe package name.

Thanks very much Jean-Pierre,

That solved my problem.

Regards,
David

Thanks very much Jean-Pierre, this solved also my case.

Wow, great find... so, we will update the web.config that we ship with to contain this!

Your Welcome;)
We decompiled the code and debugged it to solve the problem. It took us the whole day:(
=> Alana, perhaps you could think about some logging, this would help us a lot;)

I found this thread after experiencing a similar issue. I was seeing the "string is not a valid semantic version error" from Proget when npm would try to install scoped packages, but only when the npm install was automatically triggered inside Visual Studio by a change to the package.json. We already had the latest version of Proget with the change to the web.config and installs worked fine when running from command line.

Problem turned out to be the fact that Visual Studio 2015 had installed it's own copy of the npm.cmd as an external web tool. This was an older version than the one I had installed globally, but the order of external web tool locations in Visual Studio had the path to the older version listed before my system path. Making system path take precedence solved the issue.

Image Text

Just thought I'd post this here in case anyone else with a similar issue stumbles across this thread like I did.