Edit This Page

Using Yarn

Yarn comes in two generations that are configured in different ways. Yarn classic (version 1.x) reads its registry and credentials from .npmrc, the file that npm uses. Yarn Berry (version 2 and later) reads .yarnrc.yml and ignores .npmrc. Run yarn --version to see which one you have: a version that starts with 1 is Yarn classic. This page was checked with Yarn 1.22.22 and Yarn 4.18.1.

Before You Start

• An npm repository on your Repsy Open Source instance, see Creating a Private npm Registry. Its address is https://<your-repsy-host>/<repo-name>/, with the slash at the end. <your-repsy-host> stands for the host and port of your instance.
• A deploy token of the repository: Read/Write to publish, Read Only is enough to install. The username that goes with it can be any value.

Yarn Classic (1.x)

Configure

Put this into ~/.npmrc, or into the .npmrc of the project:

@foo:registry=https://<your-repsy-host>/<repo-name>/
//<your-repsy-host>/<repo-name>/:_authToken=<deploy-token>
always-auth=true

• @foo:registry sends the scope @foo to Repsy. To use the registry for every package, set registry= instead, but keep in mind that Repsy does not proxy npmjs.org.
• Yarn classic matches the key of the token against the exact address of the registry. The key has to name the repository (//<your-repsy-host>/<repo-name>/). A key that names only the host, or another repository, sends no credential.
• always-auth=true makes Yarn send the credential when it asks a private registry for an unscoped package. Without it Yarn sends none, the private registry answers 401 Unauthorized, and Yarn reports it as Couldn't find package "<package-name>" on the "npm" registry, the same message as for a package that does not exist. A scoped package works without it. Add it whenever you use a private registry as the main registry.
• A .yarnrc file is not needed. Do not use --no-default-rc: it makes Yarn ignore .npmrc, credentials included.
• yarn login only works interactively, so put the token into .npmrc. In CI, refer to an environment variable instead of the token, see Authenticating with npm.

Install

yarn add @foo/<package-name>

yarn.lock records the address Repsy serves the package from and its checksums. yarn install --frozen-lockfile installs from it.

Publish

yarn publish --non-interactive --no-git-tag-version

yarn publish packs the current directory and publishes it. It asks for a new version; --new-version <version> gives one, and --non-interactive publishes the version of package.json. --no-git-tag-version keeps Yarn from creating a git commit and tag.

Other Commands

yarn tag list <package-name>, yarn tag add <package-name>@<version> <tag> and yarn tag remove <package-name> <tag> manage dist-tags (the spellings ls and rm print a deprecation warning), and yarn info shows the metadata of a package. Yarn classic has no deprecate, unpublish, whoami, ping or search command. Use npm for them, see Managing npm Packages. yarn audit always asks registry.yarnpkg.com, so it never reaches Repsy.

Yarn Berry (2 and Later)

Configure

Create .yarnrc.yml in the project (or ~/.yarnrc.yml):

npmScopes:
  foo:
    npmRegistryServer: "https://<your-repsy-host>/<repo-name>/"
    npmPublishRegistry: "https://<your-repsy-host>/<repo-name>/"
    npmAuthToken: "<deploy-token>"

• The name of the scope is written without the @.

• npmRegistryServer is where the scope is installed from and npmPublishRegistry where it is published to. Without npmPublishRegistry, yarn npm publish of a scoped package goes to registry.yarnpkg.com.

• npmAuthToken sends the token as a Bearer credential. To use a user account instead, set npmAuthIdent: "<username>:<password>", which Yarn sends as Basic.

• Yarn Berry refuses a plain http:// registry unless its host is listed in unsafeHttpWhitelist, localhost included (YN0081). A local instance needs:

  unsafeHttpWhitelist:
    - "localhost"
  

• Yarn Berry reads no .npmrc file.

To use the registry as the main registry, set the same values at the top level, together with npmAlwaysAuth:

npmRegistryServer: "https://<your-repsy-host>/<repo-name>/"
npmAuthToken: "<deploy-token>"
npmAlwaysAuth: true

Without npmAlwaysAuth: true, Yarn asks a private registry for an unscoped package without a credential and stops with YN0041 (“Invalid authentication (as an anonymous user)”). A scoped package works without it.

In CI, use an environment variable in place of the token: npmAuthToken: "${NPM_TOKEN}".

Install

yarn add @foo/<package-name>

Plug’n’Play, hardened mode (enableHardenedMode) and yarn install --immutable work with Repsy.

Publish

yarn install
yarn npm publish

yarn npm publish packs the project itself and needs its install state, so run yarn install first. Without it Yarn stops with an internal error that says the package “doesn’t seem to be present in your lockfile”. --tag <tag> publishes under a tag. A version that already exists is sent to Repsy again, which accepts it while Package Override of the repository is on; --tolerate-republish makes Yarn read the metadata first and skip a version that Repsy already has. In a workspace, yarn workspaces foreach -A --no-private --topological npm publish publishes every package and replaces workspace: ranges with real versions.

Other Commands

• yarn npm tag list <package-name>, yarn npm tag add <package-name>@<version> <tag> and yarn npm tag remove <package-name> <tag> manage dist-tags. Yarn itself refuses to remove latest.
• yarn npm whoami prints the name of your credential. --scope foo asks the registry of the scope, and --publish the publish registry.
• yarn npm info <package-name> shows the metadata of a package, and yarn npm info <package-name>@<version> -f deprecated the deprecation message of a version. yarn add does not print anything about a deprecated version.
• yarn npm audit audits the installed packages, see Managing npm Packages.
• Yarn Berry has no deprecate, unpublish, ping or search command. Use npm. yarn npm login and yarn npm logout were not tested against Repsy: use a deploy token, and revoke it in the web UI.

Check the Result

Open the repository in the web UI: the package is listed under its scope, with its versions and dist-tags.

Troubleshooting

Authenticating with npm Using pnpm

Was this page helpful?

Yes No