Affected Packages

@changesets/cli (introduced in 2.30.0)

Problem

changeset publish fails with ENEEDAUTH when using a private npm registry that has a path component in its URL.

This was introduced in 2.30.0 by the normalizeRegistry, which strips trailing slashes from registry URLs.

The normalized URL is passed to the npm publish subprocess via npm_config_registry env override in internalPublish.

npm uses a "nerf dart" algorithm to match auth credentials in .npmrc. It calls new URL('.', registryUrl) to resolve the auth scope.

// With trailing slash (before 2.30.0):
new URL('.', 'https://nexus.example.com/npm/').toString()
// -> "https://nexus.example.com/npm/"
// nerf dart: "//nexus.example.com/npm/"
// matches "//nexus.example.com/npm/:_auth" in .npmrc

// Without trailing slash (after 2.30.0):
new URL('.', 'https://nexus.example.com/npm').toString()
// -> "https://nexus.example.com/"
// nerf dart: "//nexus.example.com/"
// resolves to PARENT path — does not match any auth entry -> ENEEDAUTH

Reproduction

https://github.com/lozinsky/changesets-normalize-registry-path-components

docker build -t changesets-normalize-registry-path-components .
docker run --rm changesets-normalize-registry-path-components

CI log

https://github.com/lozinsky/changesets-normalize-registry-path-components/actions/runs/24455893656/job/71456419197