[aws-s3-storage] Aborted tarball upload crashes the whole registry (unhandledRejection)

Filing here because verdaccio/verdaccio-aws-s3-storage has both PRs (collaborators-only) and issues disabled, so external reporting is blocked there.

Summary

In verdaccio-aws-s3-storage (12.0.4 and 12.1.1), an aborted tarball upload crashes the entire Verdaccio process — every replica, not just the request. Effectively a single-request DoS.

Root cause — src/s3PackageManager.ts, writeTarball

const uploadPromise = upload.done().catch((err) => {
  const error = convertS3Error(err);
  uploadStream.emit("error", error);
  throw error;                       // re-throws -> uploadPromise rejects
});

uploadPromise is only awaited inside onEnd(), wired to the stream end event via uploadStream.done. On a client abort mid-upload (disconnect / cancelled install / proxy timeout), uploadStream.abort() runs and onEnd() never fires → the rejected uploadPromise is never awaited → process-level unhandledRejection → process terminates.

We hit this in production: a burst of aborted tarball fetches crash-looped the registry.

Fix (2 lines)

void uploadPromise.catch(() => {});

Rejection is always consumed; the error is still delivered to the stream via emit("error").

Ready branch (PRs are collaborator-locked so I cannot open one)

Fix + regression test (asserts no unhandledRejection when done() is never called; verified it fails without the fix) + changeset, off current master:

https://github.com/ederelias/verdaccio-aws-s3-storage/tree/fix/abort-upload-crash

Please cherry-pick, or invite me to open the PR directly.