[Question] Response timeouts for packages

[bozdoz]

I saw as of npm-registry-fetch@4.0.3 that the default timeout for requests is 30s (ea0ff56)

I think that should be fine.

I'm curious about the endpoints that are being requested using npm ci for example.

My understanding is that the package-lock.json file should already have a "resolved" tarfile, and should just download that:

    "typescript": {
      "version": "4.2.4",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.2.4.tgz",
      "integrity": "sha512-V+evlYHZnQkaz8TRBuxTA92yZBPotr5H+WhQ7bD3hZUndx5tGOa1fuCgeSjxAzM1RiN5IzvadIXTVefuuwZCRg==",
      "dev": true
    }

But (given my network situation) this request can timeout; not because it's requesting the .tgz file, but because it's requesting https://registry.npmjs.org/typescript (which appears to be just a JSON list of versions?)

Why is this happening, if there is a resolved tarfile, and how could I prevent this/improve the performance of my installs?

[wraithgar]

Can you try this with the latest version of npm? Using npm@8.8.0 and a lockfile npm only fetches the tarball and not the /typescript packument.