Skip to content

feat: warn instead of error on unknown .npmrc configs#9729

Merged
reggi merged 1 commit into
latestfrom
reggi/undo-npmrc-error
Jul 8, 2026
Merged

feat: warn instead of error on unknown .npmrc configs#9729
reggi merged 1 commit into
latestfrom
reggi/undo-npmrc-error

Conversation

@reggi

@reggi reggi commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

What / Why

Unknown configuration keys in .npmrc files now emit a warning by default, restoring pre-npm-12 behavior, instead of throwing. This reverts the file-config portion of the breaking change from 979518d (#9276).

Details

  • Unknown .npmrc (file) configs → warn by default, with the pre-npm-12 wording ("This will stop working in the next major version of npm…").
  • New strict-npmrc config (Boolean, default false) → opts back into treating unknown file configs as a hard EUNKNOWNCONFIG error.
  • Unknown CLI flags and abbreviations → continue to error regardless of this setting.
  • The warning flows through npm's normal display pipeline, so it respects loglevel suppression (e.g. --loglevel=error, --silent).

Tests

  • Updated the file-config validation tests to assert warn-by-default and strict-mode error behavior.
  • Added coverage for combined cli+file unknowns under strict-npmrc, cli-only errors, and loglevel suppression.
  • Regenerated docs.js and config.js snapshots for the new config option.

@reggi
reggi requested review from a team as code owners July 7, 2026 22:18
Unknown configuration keys in .npmrc files now emit a warning by
default, restoring pre-npm-12 behavior, instead of throwing. This
reverts the breaking change from 979518d (#9276) for file-based
configs. The new `strict-npmrc` config (default false) opts back into
treating them as a hard error. Unknown CLI flags and abbreviations
continue to error regardless of this setting.

The warning flows through the normal display pipeline, so it respects
loglevel suppression (e.g. --loglevel=error, --silent).

Co-authored-by: Copilot <[email protected]>
@reggi
reggi force-pushed the reggi/undo-npmrc-error branch from 408cc0d to 618679d Compare July 7, 2026 22:23
Comment thread lib/base-cmd.js
Comment on lines +395 to +396
`Unknown ${u.where} config ${display}. This will stop working in the ` +
'next major version of npm. See `npm help npmrc` for supported config options.')

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'd suggest wording this differently, since i suspect making this behavior default will forever be too breaking to ever successfully ship.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, but i'm gonna keep this as it was before the major.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair enough :-) either way super grateful yall are reverting this one for 12.

@reggi
reggi merged commit fd75880 into latest Jul 8, 2026
45 checks passed
@reggi
reggi deleted the reggi/undo-npmrc-error branch July 8, 2026 17:23
reggi added a commit that referenced this pull request Jul 8, 2026
## What / Why

#9729 reverts the `.npmrc` file-config half of the breaking change from
`979518d` (#9276): unknown `.npmrc` configs warn by default again, and
the new `strict-npmrc` config opts back into erroring. Unknown CLI flags
and abbreviations still throw.

The `12.0.0-pre.1` changelog entry still carried the original wording,
which claimed unknown `.npmrc` configs now throw. Since release-please
aggregates every prerelease `BREAKING CHANGE` note into the eventual
stable `v12.0.0` release notes, that stale line would surface
(inaccurately) in the 12.0.0 notes. This corrects the wording in place.

## Change

Edits the single breaking-changes bullet in the `## [12.0.0-pre.1]`
section:

> unknown CLI flags, abbreviated flags, and single-hyphen multi-char
shorthands now throw instead of warning. (Unknown `.npmrc` configs still
warn by default; opt into erroring with the new `strict-npmrc` config.)

## Notes

- Manual, targeted edit to an already-released, release-please-generated
section — this does not disturb release-please, which derives versions
from git tags + commit history and only prepends new sections.
Precedent: #8298 (`chore: add contributor to changelog entry`).
- Best merged alongside / after #9729 so the corrected note reflects
shipped behavior.

Co-authored-by: Copilot <[email protected]>

Co-authored-by: Copilot <[email protected]>
SayantanCode added a commit to SayantanCode/vayo that referenced this pull request Jul 26, 2026
…tibility (#35)

The first real automated publish attempt (0.1.1-beta.2, all 9 packages)
failed identically for every package: EUNKNOWNCONFIG "Unknown cli flag:
--git-checks". Root cause confirmed via pnpm/pnpm#9646 and npm/cli#9276:
changeset publish always runs pnpm publish --no-git-checks for a pnpm
workspace, and pnpm has an open bug that mangles --no-git-checks into a
bare --git-checks before forwarding it to the underlying npm call. npm
<12 only warned about this; npm 12's breaking change (npm/cli#9276) made
unknown CLI flags a hard error, and the later walkback (npm/cli#9729)
explicitly excludes CLI flags from the softened behavior - so npm 12 will
always hard-fail here regardless of patch version. `npm install -g
npm@latest` was pulling in 12.0.1. Pinned to 11.18.0 instead - the newest
11.x release, well past the >=11.5.1 OIDC requirement, but before the
breaking change.

Nothing was actually published by the failed attempt (confirmed: all 9
packages failed identically before any registry write), so this is a
clean retry, not a partial-state cleanup.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants