Walkthrough

createPublishOptions in publishPackedPkg.ts is updated to explicitly pass strictSSL: options.strictSsl to the options object forwarded to libnpmpublish/npm-registry-fetch. Two tests verify the mapping behavior. A changeset documents the fix.

Changes

strictSsl forwarding fix for pnpm publish

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• pnpm/pnpm#11746: Also modifies createPublishOptions in publishPackedPkg.ts to forward a specific publish option (access) to libnpmpublish, the same function and pattern modified here.
• pnpm/pnpm#11581: Modifies the publish flow in publishPackedPkg.ts to forward TLS-related and registry fetch options into the underlying dispatcher, directly related to the same code path.

Suggested reviewers

• zkochan

🐇 A registry behind self-signed glass,
Would make pnpm publish simply not pass!
One line sets strictSSL,
And now certs won't stall—
Hop on through! The publish can now amass! 🎉

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn

Description

The test claims strictSSL is “absent” when strictSsl is not set, but it only asserts
opts.strictSSL is undefined, which also passes if the property exists with value undefined.
This can miss regressions where createPublishOptions stops pruning undefined keys and still
forwards a strictSSL field to downstream publish/fetch code.

Code

releasing/commands/test/publish/publishConfigAccess.test.ts[R44-50]

+  test('strictSSL is absent when strictSsl is not set', async () => {
+    const opts = await createPublishOptions(
+      { name: 'pkg', version: '1.0.0' },
+      baseOpts()
+    )
+    expect(opts.strictSSL).toBeUndefined()
+  })

Evidence

The test uses toBeUndefined(), which passes for both a missing key and a present-but-undefined
key. Meanwhile createPublishOptions() relies on pruneUndefined() to actually delete
undefined-valued keys; without an explicit “no property” assertion, the test won’t detect
regressions in that pruning behavior.

releasing/commands/test/publish/publishConfigAccess.test.ts[35-51]
releasing/commands/src/publish/publishPackedPkg.ts[194-201]
releasing/commands/src/publish/publishPackedPkg.ts[394-400]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The unit test intends to ensure `strictSSL` is not forwarded unless `strictSsl` is explicitly set, but `expect(opts.strictSSL).toBeUndefined()` cannot distinguish between a missing property and an own-property with value `undefined`.

## Issue Context
`createPublishOptions()` calls `pruneUndefined()` to delete keys with `undefined` values. If that pruning were removed/broken in the future, the current test would still pass and would not catch the regression.

## Fix Focus Areas
- releasing/commands/test/publish/publishConfigAccess.test.ts[44-50]

## Suggested change
Replace the assertion with one that checks property absence, e.g.:
- `expect(opts).not.toHaveProperty('strictSSL')` or
- `expect(Object.prototype.hasOwnProperty.call(opts, 'strictSSL')).toBe(false)`

Optionally also strengthen the first test to assert presence when set:
- `expect(opts).toHaveProperty('strictSSL', false)`

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

• Forward strictSsl to libnpmpublish as strictSSL so publish respects .npmrc/workspace
  config.
• Prevent publish failures/timeouts against registries using self-signed certificates.
• Add unit coverage to ensure strictSSL is set only when configured.

Forwarding options.strictSsl to strictSSL in the libnpmpublish options is the correct minimal fix, since the underlying fetch layer defaults to strict TLS verification unless explicitly overridden. Alternatives like globally relaxing TLS (e.g., via environment variables) are broader in scope and less safe/targeted than passing the explicit publish option.

publishPackedPkg.ts Forward strictSsl to libnpmpublish as strictSSL +1/-0

Forward strictSsl to libnpmpublish as strictSSL

• Adds 'strictSSL: options.strictSsl' to the publish options object passed to 'libnpmpublish', ensuring 'npm-registry-fetch' does not fall back to its default 'strictSSL=true' behavior during publish.

releasing/commands/src/publish/publishPackedPkg.ts

---

publishConfigAccess.test.ts Test strictSsl → strictSSL mapping in createPublishOptions +18/-0

Test strictSsl → strictSSL mapping in createPublishOptions

• Adds unit tests verifying that 'strictSsl: false' is forwarded as 'strictSSL: false', and that 'strictSSL' is omitted when 'strictSsl' is not provided.

releasing/commands/test/publish/publishConfigAccess.test.ts

---

fix-publish-strict-ssl.md Add changeset for strictSsl publish fix +6/-0

Add changeset for strictSsl publish fix

• Introduces a patch changeset documenting that 'pnpm publish' now respects 'strictSsl: false'/'strict-ssl=false' when publishing to registries with self-signed certificates.

.changeset/fix-publish-strict-ssl.md

---