fix(npm): revalidate all registry requests

Sets Cache-Control to ‘no-cache’ to instruct the http layer to always revalidate cached responses with the registry. Otherwise we can be up to 5 minutes “behind” because npmjs default cache time is 300s.

lib/datasource/npm.js

@@ -133,11 +133,14 @@ async function getPreset(pkgName, presetName = 'default') {
 }
 
 async function getDependency(name, retries = 5) {
-  logger.trace(`getPkgReleases(${name})`);
+  logger.trace(`npm.getPkgReleases(${name})`);
+
+  // This is our datastore cache and is cleared at the end of each repo, i.e. we never requery/revalidate during a "run"
   if (memcache[name]) {
     logger.trace('Returning cached result');
     return memcache[name];
   }
+
   const scope = name.split('/')[0];
   let regUrl;
   try {
@@ -173,7 +176,9 @@ async function getDependency(name, retries = 5) {
     delete headers.authorization;
   }
 
-  // Retrieve from API if not cached
+  // This tells our http layer not to serve responses directly from the cache and instead to revalidate them every time
+  headers['Cache-Control'] = 'no-cache';
+
   try {
     const raw = await got(pkgUrl, {
       cache: process.env.RENOVATE_SKIP_CACHE ? undefined : map,