[BUG] GitHub references to dependencies slow/hang #4896

dlockhart · 2022-05-13T20:53:53Z

Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

As of approximately 10AM EST today, installing using a GitHub reference on NPM 6 became slow to the point where it often simply hangs. This was not the case previously, and works on NPM 7/8.

Unfortunately there are other performance issues with the v2 lock file format also related to using GitHub references that are currently preventing an upgrade to NPM > 6.

Expected Behavior

Installing a dependency using a GitHub reference should be possible.

Steps To Reproduce

In NPM 6
Run npm install github:Brightspace/d2l-fetch or npm install Brightspace/d2l-fetch
Both of those either hang or take 7+ minutes to install

Interestingly, npm i git+https://github.com/Brightspace/d2l-fetch.git#semver:^2 installs in 0.7 seconds.

Environment

npm: 6.14.17
Node.js: 14.19.2
OS Name: macOS 12.3.1
System Model Name: Apple MacBook Pro (2019)
npm config:

; cli configs
metrics-registry = "https://registry.npmjs.org/"
scope = ""
user-agent = "npm/6.14.17 node/v14.19.2 darwin x64"

; node bin location = /Users/<username>/.nvm/versions/node/v14.19.2/bin/node
; cwd = /Users/<username>/source
; HOME = /Users/<username>
; "npm config ls -l" to show all defaults.

The text was updated successfully, but these errors were encountered:

ljharb · 2022-05-13T21:13:17Z

Seems similar to #4895, but for swapped npm versions. Maybe something on GitHub’s side?

dlockhart · 2022-05-13T21:27:10Z

This is happening to everyone at our company -- Mac, Windows, inside GitHub Actions runners -- everywhere. (I don't think it's a Mac-specific issue).

marcesher · 2022-05-14T15:12:06Z

Definitely seeing this issue, starting Friday May 13th sometime early to mid-afternoon Eastern time

Here's what I see now. Installing with git+https:

time npm install git+https://github.com/segment-integrations/analytics.js-integration-segmentio.git#35b24a7505ac05111a045ee07e75096815faaa08
...

+ @segment/[email protected]
added 56 packages from 19 contributors and audited 56 packages in 9.827s
found 1 low severity vulnerability
  run `npm audit fix` to fix them, or `npm audit` for details

real	0m10.404s
user	0m1.944s
sys	0m0.701s

and with github::

Note: this isn't even installing from scratch, just running the same npm install with a different protocol

time npm install github:segment-integrations/analytics.js-integration-segmentio#35b24a7505ac05111a045ee07e75096815faaa08
...

+ @segment/[email protected]
updated 1 package and audited 86 packages in 463.228s
found 2 low severity vulnerabilities
  run `npm audit fix` to fix them, or `npm audit` for details

real	7m44.153s
user	0m5.764s
sys	0m1.008s

Importantly, this is with an older version... nodejs 12.22.12 / npm 6.14.16

When I try the most recent node... 16.15.0 with npm 8.5.5, I see no difference in time

grassick · 2022-05-15T20:11:24Z

If you run npm with -ddd you'll see the failure is attempting to run git ls-remote. e.g.

git ls-remote -h -t git://github.com/mWater/jsonql.git

This also runs slow on the command line. But replacing it with:

git ls-remote -h -t ssh://[email protected]/mWater/jsonql.git

or

git ls-remote -h -t https://github.com/mWater/jsonql.git

Are both fast.

So it's trying to use the git protocol, which is odd. It's not supported by GitHub anymore: https://github.blog/2021-09-01-improving-git-protocol-security-github/

grassick · 2022-05-15T20:22:44Z

Even more disturbing, if you change the dependency to explicitly use ssh:

e.g. "jsonql": "git+ssh://[email protected]:mWater/jsonql.git",

It still times out attempting to get it over git protocol!

e.g.:
npm sill pacote Retrying git command: ls-remote -h -t git://github.com/mWater/jsonql.git attempt # 2

grassick · 2022-05-15T20:39:25Z

I have a solution that works for me:

Run git config --global url."ssh://git@".insteadOf git://

This appears to configure it to use ssh instead of the git protocol which no longer works.

ghost · 2022-05-16T07:52:26Z

Experiencing this issue also with Node 14.19.0 & npm 6.14.17.

Before experimenting with the workarounds, would be awesome to resolve why this started just this suddenly 🤷 ...

Chuckytuh · 2022-05-16T09:50:49Z

We experienced the same slowness on 6.14.11, we found out that updating npm to version 7.16.0 (at least, that was our go to version for other reasons) solved the issue., although it's not clear the root cause.

slavoroi · 2022-05-16T12:38:07Z

Similar issues happening to our repos with github packages.

node: 16.13.0
npm: 6.14.17 (was updated from 6.14.15)
OS: Ubuntu 20.04

We started experiencing slowness since yesterday.
A simple npm i takes a long long time.

*** Solved it by removing a package named:
"@types/mysql2": "github:types/mysql2"

And updating mysql2 which had types.

…l from github The switch to node v16 gets use npm v8, to workaround an issue with slow 'npm install <any github repo dependency>'. See: npm/cli#4896 In our case the github repo dependency was the command given to docker run this container: bash -c "npm install elastic-apm-node#SOME-COMMIT-SHA && node app.js" This also adds a package.json to more explicitly declare we are working with a node project workspace. Also avoid generating a package-lock file we won't use. Fixes: #1483

…ue with github deps [email protected] (and only that version) has a github dep: "@types/mysql": "types/mysql", Attempting to install that version with npm v6 (the npm in node v10, v12, and v14) hits npm/cli#4896 which results in an install so slow that is hits the default 2 minute 'npm install' timeout in the `tav` tool.

…l from github (#1484) The switch to node v16 gets use npm v8, to workaround an issue with slow 'npm install <any github repo dependency>'. See: npm/cli#4896 In our case the github repo dependency was the command given to docker run this container: bash -c "npm install elastic-apm-node#SOME-COMMIT-SHA && node app.js" This also adds a package.json to more explicitly declare we are working with a node project workspace. Also avoid generating a package-lock file we won't use. Fixes: #1483

…ue with github deps (#2696) [email protected] (and only that version) has a github dep: "@types/mysql": "types/mysql", Attempting to install that version with npm v6 (the npm in node v10, v12, and v14) hits npm/cli#4896 which results in an install so slow that is hits the default 2 minute 'npm install' timeout in the `tav` tool.

See npm/cli#4896

eldadpuzach · 2022-05-17T06:37:58Z

node: v11.13.0
npm: v6.7.0

Our npm ci build step duration increased from ~4min to ~45min.

Solved by replacing github protocol with https
at package-lock.json & package.json
e.g.:

-    "angular-daterangepicker": "github:fragaria/angular-daterangepicker",
+    "angular-daterangepicker": "https://github.com/fragaria/angular-daterangepicker",

mtrezza · 2022-05-18T16:18:28Z

Here is what fixed the issue for me in AWS EC2 / ElasticBeanstalk deployment of a Node.js app:

Run a command in .ebextensions with:

commands:
  01-configure-git:
    command: sudo git config --system url."https://github".insteadOf "git://github"
    ignoreErrors: true # optionally, so deployment doesn't fail in case the command fails for some reason

Only checking your own package.json and changing the protocol may not be enough. If there are dependencies that are also referencing their own dependencies directly in GitHub using the git protocol. The above solution accounts for all of them.

joeycozza · 2022-05-18T16:52:09Z

To go along with @mtrezza 's comment. If you need to address this in Travis CI, you can add it to the before_install section of your .travis.yml file like this. That addressed the issue for us.

before_install:
  - git config --global url."https://git@".insteadOf git://

TPXP · 2022-05-19T10:13:04Z

The root cause of the issue is that github disabled the git:// protocol for pulling repos. See their blog article and this StackOverflow answer.

It'd be awesome to release a fix for the NPM v6 series 🙏 .

mtrezza · 2022-05-19T10:39:47Z

Every npm version that is still under LTS should actually receive a fix for this. It became a bug to use the git protocol and in many cases npm resolves a GitHub reference without explicit protocol to that disabled protocol.

marcesher · 2022-05-19T16:09:00Z

Does this mean that despite the deprecation schedule mentioned in that post, they didn't actually remove support until this past Friday May 13th?

dlockhart · 2022-05-19T16:54:40Z

Does this mean that despite the deprecation schedule mentioned in that post, they didn't actually remove support until this past Friday May 13th?

That's my interpretation of what happened, yeah. Maybe GitHub figured it was better to do something like that on a Friday the 13th?

…ue with github deps (#2696) [email protected] (and only that version) has a github dep: "@types/mysql": "types/mysql", Attempting to install that version with npm v6 (the npm in node v10, v12, and v14) hits npm/cli#4896 which results in an install so slow that is hits the default 2 minute 'npm install' timeout in the `tav` tool.

eyudin · 2022-05-20T11:36:54Z

I patched pacote in node-v14.17.6 like this:

diff --git a/lib/node_modules/npm/node_modules/pacote/lib/fetchers/git.js b/lib/node_modules/npm/node_modules/pacote/lib/fetchers/git.js
--- a/lib/node_modules/npm/node_modules/pacote/lib/fetchers/git.js
+++ b/lib/node_modules/npm/node_modules/pacote/lib/fetchers/git.js
@@ -85,13 +85,8 @@ Fetcher.impl(fetchGit, {
 
 function hostedManifest (spec, opts) {
   return BB.resolve(null).then(() => {
-    if (!spec.hosted.git()) {
-      throw new Error(`No git url for ${spec}`)
-    }
-    return plainManifest(spec.hosted.git(), spec, opts)
-  }).catch(err => {
     if (!spec.hosted.https()) {
-      throw err
+      throw new Error(`No https url for ${spec}`)
     }
     return plainManifest(spec.hosted.https(), spec, opts)
   }).catch(err => {
@@ -99,6 +94,11 @@ function hostedManifest (spec, opts) {
       throw err
     }
     return plainManifest(spec.hosted.sshurl(), spec, opts)
+  }).catch(err => {
+    if (!spec.hosted.git()) {
+      throw err
+    }
+    return plainManifest(spec.hosted.git(), spec, opts)
   })
 }

This completely solved the problem for github shortcuts.

david-benes · 2022-05-20T12:50:31Z

fixed by replacing npm with yarn

dungld-2897 · 2022-05-26T01:30:12Z

I am facing this issue and the solution is change package which need to be downloaded by npm from Github repo like this:
"ckeditor4": "github:ckeditor/ckeditor4-releases#full/latest",
to:
"ckeditor4": "4.19.0",
I don't know why this happened but this temp method help me out of this issue

obataku · 2022-07-19T22:47:33Z

any word on whether a fix will be backporteed to npm 6? given LTS for node 14

jrichardsz · 2023-02-27T21:49:07Z

Here is what fixed the issue for me in AWS EC2 / ElasticBeanstalk deployment of a Node.js app:

Run a command in .ebextensions with:
commands:
  01-configure-git:
    command: sudo git config --system url."https://github".insteadOf "git://github"
    ignoreErrors: true # optionally, so deployment doesn't fail in case the command fails for some reason
Only checking your own package.json and changing the protocol may not be enough. If there are dependencies that are also referencing their own dependencies directly in GitHub using the git protocol. The above solution accounts for all of them.

Thank men, this worked for me inside of docker:

git config --system url."https://github".insteadOf "git://github"

Linux
Docker
nodejs 14
npm 6.14.17

Reasons to bump: 1. Both downstream repos use Node.js 16 now. 2. NPM 6 (bundled with Node.js 14) is slow to install Auspice from a GitHub commit reference. Later versions of NPM should fix this¹. ¹ npm/cli#4896

dlockhart added Bug thing that needs fixing Needs Triage needs review for next steps Release 8.x work is associated with a specific npm 8 release labels May 13, 2022

grassick mentioned this issue May 15, 2022

pnpm install stuck for ~2 minutes pnpm/pnpm#4739

Closed

trentm mentioned this issue May 16, 2022

apm-agent-nodejs integration tests are failing because of slow npm install from github elastic/apm-integration-testing#1483

Closed

trentm mentioned this issue May 16, 2022

fix: use npm v8 in expressapp container to workaround slow npm install from github elastic/apm-integration-testing#1484

Merged

trentm mentioned this issue May 16, 2022

test: skip [email protected] in TAV tests to workaround npm v6 install issue with github deps elastic/apm-agent-nodejs#2696

Merged

sgravrock added a commit to jasmine/jasmine that referenced this issue May 17, 2022

Fixed failing CI builds for Node 12 and 14

f7eaa5e

See npm/cli#4896

balakrishna-deriv mentioned this issue May 18, 2022

check slow build deriv-com/deriv-app#5469

Merged

18 tasks

luizrrodrigues mentioned this issue May 18, 2022

CircleCI - Timeout fix topcoder-platform/community-app#6346

Merged

pixleight mentioned this issue May 18, 2022

FileSaver dependecy: npm install failed parallax/jsPDF#3420

Closed

luizrrodrigues mentioned this issue May 18, 2022

CircleCI Git URL fix topcoder-platform/community-app#6348

Merged

luizrrodrigues mentioned this issue May 20, 2022

CircleCI - Deployment fail topcoder-platform/community-app#6349

Closed

redbugz mentioned this issue May 20, 2022

Fix npm issue to have git always use https fs-webdev/heroku-buildpack-github-netrc#1

Merged

bertdeblock mentioned this issue May 21, 2022

Temporarily skip failing ember new test for npm versions <= v6.0.0 ember-cli/ember-cli#9914

Merged

nxhack mentioned this issue May 23, 2022

Impact of Git Protocol Security on GitHub nxhack/openwrt-node-packages#1283

Closed

Apollon77 mentioned this issue May 23, 2022

Adapter installation from git starts first after manually kill of "git ls-remote -h -t git://github.com/iobroker-community-adapters/..." process ioBroker/ioBroker.admin#1471

Closed

kaakaa mentioned this issue May 26, 2022

Fix ci error matterpoll/matterpoll#430

Merged

fturmel mentioned this issue May 31, 2022

Date fns hangs when running npm install date-fns/date-fns#3067

Closed

mccalluc mentioned this issue Jul 13, 2022

Cypress has gotten much slower hubmapconsortium/portal-ui#2683

Closed

obataku mentioned this issue Jul 19, 2022

Update Python runtimes and add Python 3.10 runtime aws/aws-codebuild-docker-images#505

Closed

witemple-msft mentioned this issue Aug 4, 2022

[identity] Partially revert #19356 Azure/azure-sdk-for-js#22808

Merged

mickmister mentioned this issue Aug 18, 2022

Configure git to use ssh rather than unsupported git:// protocol mattermost/circleci-orbs#31

Merged

cmawhorter mentioned this issue Aug 21, 2022

[BUG] Big performance issues and possible memory leak #3208

Open

victorlin mentioned this issue Oct 6, 2022

Restore nextstrain.org PRs nextstrain/auspice#1565

Merged

3 tasks

victorlin mentioned this issue Apr 7, 2023

dev: Update workflow which creates PRs for nextstrain.org to account for Auspice move there nextstrain/auspice#1661

Merged

2 tasks

victorlin mentioned this issue Apr 7, 2023

make_pr_for_downstream_repo: Use Node.js 16 nextstrain/auspice#1662

Merged

3 tasks

victorlin mentioned this issue Oct 18, 2024

Downstream PR preview creation and build slowness/timeouts nextstrain/auspice#1709

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BUG] GitHub references to dependencies slow/hang #4896

[BUG] GitHub references to dependencies slow/hang #4896

dlockhart commented May 13, 2022 •

edited

Loading

ljharb commented May 13, 2022

dlockhart commented May 13, 2022 •

edited

Loading

marcesher commented May 14, 2022

grassick commented May 15, 2022

grassick commented May 15, 2022

grassick commented May 15, 2022

ghost commented May 16, 2022

Chuckytuh commented May 16, 2022 •

edited

Loading

slavoroi commented May 16, 2022 •

edited

Loading

eldadpuzach commented May 17, 2022 •

edited

Loading

mtrezza commented May 18, 2022

joeycozza commented May 18, 2022 •

edited

Loading

TPXP commented May 19, 2022 •

edited

Loading

mtrezza commented May 19, 2022 •

edited

Loading

marcesher commented May 19, 2022

dlockhart commented May 19, 2022

eyudin commented May 20, 2022

david-benes commented May 20, 2022

dungld-2897 commented May 26, 2022

obataku commented Jul 19, 2022

jrichardsz commented Feb 27, 2023

[BUG] GitHub references to dependencies slow/hang #4896

[BUG] GitHub references to dependencies slow/hang #4896

Comments

dlockhart commented May 13, 2022 • edited Loading

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

ljharb commented May 13, 2022

dlockhart commented May 13, 2022 • edited Loading

marcesher commented May 14, 2022

grassick commented May 15, 2022

grassick commented May 15, 2022

grassick commented May 15, 2022

ghost commented May 16, 2022

Chuckytuh commented May 16, 2022 • edited Loading

slavoroi commented May 16, 2022 • edited Loading

eldadpuzach commented May 17, 2022 • edited Loading

mtrezza commented May 18, 2022

joeycozza commented May 18, 2022 • edited Loading

TPXP commented May 19, 2022 • edited Loading

mtrezza commented May 19, 2022 • edited Loading

marcesher commented May 19, 2022

dlockhart commented May 19, 2022

eyudin commented May 20, 2022

david-benes commented May 20, 2022

dungld-2897 commented May 26, 2022

obataku commented Jul 19, 2022

jrichardsz commented Feb 27, 2023

dlockhart commented May 13, 2022 •

edited

Loading

dlockhart commented May 13, 2022 •

edited

Loading

Chuckytuh commented May 16, 2022 •

edited

Loading

slavoroi commented May 16, 2022 •

edited

Loading

eldadpuzach commented May 17, 2022 •

edited

Loading

joeycozza commented May 18, 2022 •

edited

Loading

TPXP commented May 19, 2022 •

edited

Loading

mtrezza commented May 19, 2022 •

edited

Loading