Skip to content

Fix publish otp for yarn berry#741

Merged
sindresorhus merged 3 commits intosindresorhus:mainfrom
mifi:fix-yarn-publish-otp
Apr 7, 2024
Merged

Fix publish otp for yarn berry#741
sindresorhus merged 3 commits intosindresorhus:mainfrom
mifi:fix-yarn-publish-otp

Conversation

@mifi
Copy link
Copy Markdown
Contributor

@mifi mifi commented Apr 5, 2024

symptom: hangs forever here:

  ✔ Prerequisite check
  ✔ Git
  ✔ Installing dependencies using yarn-berry
  ✔ Running tests
  ✔ Bumping version
  ⠦ Publishing package

I aborted it and tried to run the command manually and I can see that it prompts for a OTP on stdout:

yarn npm publish
➤ YN0000: LICENSE
➤ YN0000: README.md
➤ YN0000: index.js
➤ YN0000: package.json
✖ One-time password: · 

Looking at the np otp implementation it seems that npm and yarn v1 will exit with an error when an OTP is encountered:

if (error.stderr.includes('one-time pass') || error.stdout.includes('Two factor authentication')) {

however yarn berry doesn't exit, it just prints the OTP prompt and hangs forever. this PR will help kill it off so that OTP can be prompted to the user and then re-run the cmd. not the cleanest but it works.

kind of related to #725

@sindresorhus
Copy link
Copy Markdown
Owner

CI is failing

@sindresorhus sindresorhus merged commit 02f60c7 into sindresorhus:main Apr 7, 2024
Vylpes pushed a commit to Vylpes/random-bunny that referenced this pull request Jun 10, 2024
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [np](https://github.com/sindresorhus/np) | devDependencies | major | [`^9.0.0` -> `^10.0.0`](https://renovatebot.com/diffs/npm/np/9.2.0/10.0.5) |

---

### Release Notes

<details>
<summary>sindresorhus/np (np)</summary>

### [`v10.0.5`](https://github.com/sindresorhus/np/releases/tag/v10.0.5)

[Compare Source](sindresorhus/np@v10.0.4...v10.0.5)

-   Fix npm 10 compatibility for real ([#&#8203;744](sindresorhus/np#744))  [`34409be`](sindresorhus/np@34409be)

### [`v10.0.4`](https://github.com/sindresorhus/np/releases/tag/v10.0.4)

[Compare Source](sindresorhus/np@v10.0.3...v10.0.4)

-   Fix compatibility with npm 10 ([#&#8203;743](sindresorhus/np#743))  [`4caa295`](sindresorhus/np@4caa295)

### [`v10.0.3`](https://github.com/sindresorhus/np/releases/tag/v10.0.3)

[Compare Source](sindresorhus/np@v10.0.2...v10.0.3)

-   Fix publish OTP for Yarn Berry ([#&#8203;741](sindresorhus/np#741))  [`02f60c7`](sindresorhus/np@02f60c7)

### [`v10.0.2`](https://github.com/sindresorhus/np/releases/tag/v10.0.2)

[Compare Source](sindresorhus/np@v10.0.1...v10.0.2)

-   Use npm for tagging versions when pnpm is the chosen package manager ([#&#8203;739](sindresorhus/np#739))  [`770418f`](sindresorhus/np@770418f)

### [`v10.0.1`](https://github.com/sindresorhus/np/releases/tag/v10.0.1)

[Compare Source](sindresorhus/np@v10.0.0...v10.0.1)

-   Fix compatibility with npm 10 ([#&#8203;737](sindresorhus/np#737))  [`9fdebd5`](sindresorhus/np@9fdebd5)

### [`v10.0.0`](https://github.com/sindresorhus/np/releases/tag/v10.0.0)

[Compare Source](sindresorhus/np@v9.2.0...v10.0.0)

##### Breaking

-   Remove the `--yarn` flag ([#&#8203;730](sindresorhus/np#730))  [`4b3b599`](sindresorhus/np@4b3b599)
    -   The functionality is replaced by `--package-manager`. See below.

##### Improvements

-   Add `--package-manager` flag ([#&#8203;730](sindresorhus/np#730))  [`4b3b599`](sindresorhus/np@4b3b599)
    -   This acts like the [`packageManager` field](https://nodejs.org/api/packages.html#packagemanager) in package.json. `np` will default to reading package.json, and look for lockfiles to determine the best package manager as a last resort.
-   Add pnpm support ([#&#8203;730](sindresorhus/np#730))  [`4b3b599`](sindresorhus/np@4b3b599)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4wLjAiLCJ1cGRhdGVkSW5WZXIiOiIzNy4wLjAiLCJ0YXJnZXRCcmFuY2giOiJkZXZlbG9wIn0=-->

Reviewed-on: https://git.vylpes.xyz/RabbitLabs/random-bunny/pulls/159
Co-authored-by: Renovate Bot <renovate@vylpes.com>
Co-committed-by: Renovate Bot <renovate@vylpes.com>
@ryami333
Copy link
Copy Markdown

ryami333 commented Jan 6, 2026

This doesn't work for me, on Yarn 4.9.2 and np 10.2.0. I still just get the hang on "Publishing package" despite it correctly prompting me for an OTP when I just do yarn npm publish directly.

@mifi
Copy link
Copy Markdown
Contributor Author

mifi commented Jan 7, 2026

I incidentally just ran this 4 days ago with "packageManager": "yarn@4.12.0", and np@10.2.0 and it did successfully prompt me for OTP and publish the package. could you try latest yarn?

@ryami333
Copy link
Copy Markdown

ryami333 commented Jan 7, 2026

Yep, just bumped to 4.12.0, and the same thing happens:

mitch@MacBookPro my-package % yarn np patch --no-tests

Publish a new version of my-package (current: 0.2.6, next: 0.2.7)


  ✔ Prerequisite check
  ✔ Git
  ✔ Installing dependencies using yarn-berry
  ✔ Bumping version
  ⠼ Publishing package
    Pushing tags

For what it's worth, the output of my yarn npm publish looks different to yours:

mitch@MacBookPro my-package % yarn npm publish        
➤ YN0000: LICENSE.md
➤ YN0000: README.md
…(collapsed list of package artefacts)
➤ YN0000: package.json
➤ YN0000: Open https://www.npmjs.com/login/[REDACTED] to use your security key for authentication or enter OTP from your authenticator app
? Do you want to try to open this url now? (Y/n) › true

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants