npm tags in group repositories not correctly resolved

[leabaertschi]

• What problem are you trying to solve?

We have a Nexus 3 with a group npm repositories. In there are the following repositories:

• npm-releases
• npm-snapshots

To npm-releases we only publish packages with tag latest and to npm-snapshots we only publish packages with tag canary. Nevertheless, when accessing the meta data for a package in npm-snapshots, the dist-tags contain the expected canary tag, but also a latest tag with the same version (they are all pre-release versions like 1.3.0-story-4750.3). The metadata in the npm-releases repo correctly only shows a latest tag with the stable version of the latest release. When looking now at the metadata of said package in the group repo it shows the latest and canary tags from npm-snapshots, although npm-releases comes first in the order of repositories.

In my opinion there are two things that don't work as expected:

1. in npm-snapshots there should be no latest tag
2. due to the order of repos the latest tag should not have the version from the npm-snapshots repo

• Do you have a workaround you are using at present? no

• What feature or behavior is this required for? npm install package@latest installs the correct version

• Tell us about your Nexus Repository deployment: what version, operating system, and database are you using? OSS 3.66.0-02 Linux OrientDB