Couldn't download xlsx package

[binLep]

"xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"

 WARN aube_registry::client::request: retrying HTTP request after transport error attempt=1 max_attempts=3 backoff_ms=10000 error=error sending request for url (https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz) label="https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz" code="WARN_AUBE_HTTP_RETRY_TRANSPORT"

then I use npm to install

aube 1.37.0 by jdx.dev  [                                                                                                                                                                                              ]
ERR_AUBE_REGISTRY_ERROR

  × registry error for xlsx: registry packument has no metadata for xlsx@0.20.3
  help: package: xlsx
        packument fetch failed — verify the registry URL in .npmrc, check auth (`npm login` / `NPM_TOKEN`), and confirm network connectivity

[jdx]

Thanks for the report — I reproduced the lockfile path and found the cause.

npm uses the same HTTP(S) resolved field for registry packages and direct tarball dependencies. Aube imported the SheetJS entry from package-lock.json as a registry package, so the default trustPolicy=no-downgrade check queried npm for xlsx@0.20.3. That version is distributed from the SheetJS CDN and is not present in the npm packument, which caused registry packument has no metadata for xlsx@0.20.3.

The fix is in #1277. It preserves matching declared URL dependencies as remote-tarball sources, including their integrity, while leaving ordinary registry tarball URLs unchanged.

Until a release containing the fix is available, trust-policy=off avoids this specific package-lock.json validation failure. The earlier HTTP retry appears separate/transient; the CDN URL is currently responding successfully.

AI-assisted — Tool: Codex; model: unavailable; version: unavailable.

[binLep]

Thank you for your answer. 😊