About --tolerate-republish

[alecmev]

Self-service

• I'd be willing to implement a fix, if this needs fixing

Describe the bug

The word "tolerate" means:

Allow the existence, occurrence, or practice of (something that one dislikes or disagrees with) without interference.

So "tolerate republish" would mean "it's okay to republish". But the description of the flag suggests otherwise:

berry/packages/plugin-npm-cli/sources/commands/npm/publish.ts

Lines 37 to 39 in ed91923

	tolerateRepublish = Option.Boolean(`--tolerate-republish`, false, {
	description: `Warn and exit when republishing an already existing version of a package`,
	});

And so does the implementation:

berry/packages/plugin-npm-cli/sources/commands/npm/publish.ts

Lines 70 to 91 in ed91923

	if (this.tolerateRepublish) {
	try {
	const registryData = await npmHttpUtils.get(npmHttpUtils.getIdentUrl(ident), {
	configuration,
	registry,
	ident,
	jsonResponse: true,
	});
	if (!Object.prototype.hasOwnProperty.call(registryData, `versions`))
	throw new ReportError(MessageName.REMOTE_INVALID, `Registry returned invalid data for - missing "versions" field`);
	if (Object.prototype.hasOwnProperty.call(registryData.versions, version)) {
	report.reportWarning(MessageName.UNNAMED, `Registry already knows about version ${version}; skipping.`);
	return;
	}
	} catch (err) {
	if (err.originalError?.response?.statusCode !== 404) {
	throw err;
	}
	}
	}

However, this is out for over three years, so I feel like this would've been caught by now. Am I missing something?

[arcanis]

Publishing a package over an existing version isn't possible on registries - they would crash, and the process would exit with an error code. This is problematic when using yarn workspaces foreach npm publish, as it could stop the iteration.

Adding --tolerate-republish tells Yarn that if the package already exists, then it's fine to skip the "republish" error and exit without error code. To this end we check for the package existence first, since it allows us to skip the yarn pack call for all packages that don't need publishing.

[alecmev]

Thank you! Sorry for not posting this in the discussions in the first place. Would it make sense to rename this flag to --tolerate-conflict-error perhaps, or something like that? I'm new to publishing, so it didn't even occur to me that the registries are append-only. Or at least a mention in the docs, saying that a PUT of an existing version always results in a 409, and the use case you described.

[arcanis]

I don't think the value is high enough to be worth a breaking change, tbh 😅

[alecmev]

That's true! Is a doc update welcome though?