Conversation
Restores compatibility with environments that point npm at a custom
.npmrc via NPM_CONFIG_USERCONFIG (e.g. actions/setup-node writing to
${runner.temp}/.npmrc), which silently broke after the v11 env var
prefix change. PNPM-prefixed env vars and npmrcAuthFile from the
global config.yaml continue to take precedence.
Closes #11539
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughpnpm now honors the ChangesNPM_CONFIG_USERCONFIG Fallback Support
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/reader/src/index.ts`:
- Around line 234-235: The code uses the nullish coalescing operator with
env.npm_config_userconfig and env.NPM_CONFIG_USERCONFIG, which treats an empty
string as a valid value and can short-circuit fallbacks; change the selection
logic so empty strings are treated as unset (e.g., test for truthiness or coerce
empty strings to undefined) when resolving the auth-file path, updating the
expression that currently uses "env.npm_config_userconfig ??
env.NPM_CONFIG_USERCONFIG" to explicitly ignore '' and allow subsequent
fallbacks to run.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 41857bd7-dab0-4571-965a-1bcda7479651
📒 Files selected for processing (3)
.changeset/honor-npm-config-userconfig.mdconfig/reader/src/index.tsconfig/reader/test/index.ts
Contributor
There was a problem hiding this comment.
Pull request overview
This PR restores npm-compat behavior in @pnpm/config.reader by treating NPM_CONFIG_USERCONFIG / npm_config_userconfig as a lowest-priority fallback for selecting the user-level .npmrc, fixing authentication flows in CI environments (notably actions/setup-node) that rely on these env vars.
Changes:
- Add
npm_config_userconfig/NPM_CONFIG_USERCONFIGas a low-priority fallback when computing which user.npmrcto load. - Add unit tests covering the new fallback and precedence vs PNPM-prefixed env vars and global
config.yaml. - Add a changeset for patch releases of
@pnpm/config.readerandpnpm.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
config/reader/src/index.ts |
Extends early .npmrc path resolution to include npm-prefixed *_USERCONFIG env vars as the lowest-priority fallback. |
config/reader/test/index.ts |
Adds tests validating npm-prefixed env var support and correct precedence behavior. |
.changeset/honor-npm-config-userconfig.md |
Documents the behavior change and ships patch bumps. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
`??` accepts an empty string as a defined value, so an exported but
unset NPM_CONFIG_USERCONFIG would short-circuit the fallback chain and
make normalizePath('') resolve to process.cwd(). Mirror readEnvVar's
empty-string-to-undefined coercion via a readNpmEnvVar helper so the
fallback to ~/.npmrc works as expected.
zkochan
added a commit
that referenced
this pull request
May 8, 2026
…11545) * fix(config): honor NPM_CONFIG_USERCONFIG as a low-priority fallback Restores compatibility with environments that point npm at a custom .npmrc via NPM_CONFIG_USERCONFIG (e.g. actions/setup-node writing to ${runner.temp}/.npmrc), which silently broke after the v11 env var prefix change. PNPM-prefixed env vars and npmrcAuthFile from the global config.yaml continue to take precedence. Closes #11539 * fix(config): treat empty NPM_CONFIG_USERCONFIG as unset `??` accepts an empty string as a defined value, so an exported but unset NPM_CONFIG_USERCONFIG would short-circuit the fallback chain and make normalizePath('') resolve to process.cwd(). Mirror readEnvVar's empty-string-to-undefined coercion via a readNpmEnvVar helper so the fallback to ~/.npmrc works as expected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NPM_CONFIG_USERCONFIG(and lowercasenpm_config_userconfig) as the lowest-priority fallback when locating the user-level.npmrc.actions/setup-node, which writes registry credentials to${runner.temp}/.npmrcand exportsNPM_CONFIG_USERCONFIGto point at it. This silently broke in pnpm v11 because the env var loader only honorsPNPM_CONFIG_*/pnpm_config_*prefixes, leaving GitHub Actions workflows that authenticate to private registries unable to install.PNPM_CONFIG_USERCONFIG,PNPM_CONFIG_NPMRC_AUTH_FILE, andnpmrcAuthFilein the globalconfig.yamlcontinue to take precedence — the npm-prefixed env var only kicks in when nothing pnpm-native is set.Priority order (highest → lowest):
--npmrc-auth-file/--userconfigCLI flagsPNPM_CONFIG_NPMRC_AUTH_FILE/pnpm_config_npmrc_auth_filePNPM_CONFIG_USERCONFIG/pnpm_config_userconfignpmrcAuthFilein global~/.config/pnpm/config.yaml(pnpm-native)npm_config_userconfig/NPM_CONFIG_USERCONFIG(new npm-compat fallback)~/.npmrc(default)Closes #11539.
Test plan
NPM_CONFIG_USERCONFIGis read from envnpm_config_userconfig(lowercase) is read from envPNPM_CONFIG_USERCONFIGwins overNPM_CONFIG_USERCONFIGwhen both setnpmrcAuthFilefrom globalconfig.yamlwins overNPM_CONFIG_USERCONFIGWritten by an agent (Claude Code, claude-opus-4-7).
Summary by CodeRabbit
Release Notes