NpmProxyFacetImpl.mergeNewRootWithExistingRoot was added in 3.13.0 under
NEXUS-15714 to handle situations where we have previously proxied NPM packages that no longer exist on the remote. It does this by iterating over versions that no longer appear in the new package root, checking to see if any records exist for them locally. To do this it needs to load any existing package root.
Unfortunately this introduces a window where the proxy facet could load an existing package root record, only to find that the referenced blob has since been replaced by another thread. This can happen in HA when the package root is being updated from multiple nodes. This will cause a retry whereas before the new package root would simply be replaced.
The reason we'd prefer to retry is so we don't lose any cached NPM package versions that no longer exist in the upstream package root. If we never retried and just saved the (un-merged) upstream package root then we could potentially lose that cached information. That said, removal of upstream package versions should be rare - and failing to proxy the package root just because the existing root went away between loading the record and fetching the blob is not very robust.
One option is to always ignore when an existing package root's blob is not available.
Another option would be to allow retries, but if we reach the retry limit (you can tell this by catching RetryDeniedException) then go ahead and cache the upstream package root without merging.