Skip to content

[rush-lib] Update [dot]npmrc #5296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

[rush-lib] Update [dot]npmrc #5296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
23c7106
Update [dot]npmrc
L-Qun Aug 5, 2025
ba65f8c
rush change
L-Qun Aug 5, 2025
2715726
Update common/changes/@microsoft/rush/patch-1_2025-08-05-13-22.json
L-Qun Aug 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions common/changes/@microsoft/rush/patch-1_2025-08-05-13-22.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"changes": [
{
"packageName": "@microsoft/rush",
"comment": "Remove the public NPM registry from the `.npmrc` generated during `rush init`. The public registry is the default, and including it in the repo's default `.npmrc` will override the user's default registry.",
"type": "none"
}
],
"packageName": "@microsoft/rush"
}
2 changes: 1 addition & 1 deletion libraries/rush-lib/assets/rush-init/common/config/rush/[dot]npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
#

# Explicitly specify the NPM registry that "rush install" and "rush update" will use by default:
registry=https://registry.npmjs.org/
# registry=https://registry.npmjs.org/
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤔 There was originally some reason why this was needed, maybe for Azure DevOps? I will ask some other maintainers about it at Rush Hour tomorrow.

Copy link
Collaborator

@octogonz octogonz Aug 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually I think the problem is like this:

1. Person A has no ~/.npmrc user file on their computer. They run rush update --full, so the pnpm-lock.yaml file is created using versions from registry=https://registry.npmjs.org/. Let's say this is the correct behavior.

2. Person B is working in some other repository, where they are instructed to configure a private registry in their ~/.npmrc user file.

3. Next, Person B clones the monorepo and runs rush install. It mostly works, because the private registry has most of the same packages as npmjs.org. But a few versions are missing, maybe because a security policy delays syncing of very new versions.

4. Thus, for Person B, rush install prints a confusing error about missing versions. Why is it broken?

5a. Person B asks for on call support. Person A tries to reproduce the error, but "it works fine for me" (because they are missing the .npmrc file).

- OR -

5b. Person B "fixes" the problem by running rush update --full. Now the lockfile matches their registry. But when they create a pull request, it fails in CI, because the CI machine has no ~/.npmrc user file. What??

The core problem is that rush install is not behaving deterministically. Ideally there should be no ~/.npmrc at all, but 90% of the common problems can be avoided by explicitly specifying registry= in common/config/rush/.npmrc.

Of course, having the wrong default in common/config/rush/.npmrc will also cause confusion, but that's still better than nondeterministic errors.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Users typically won’t notice this configuration after generation, but they’ll have to spend time later figuring out why things are failing. Usually, every company has its own registry, which means as long as they run this command, they’re guaranteed to run into issues

@L-Qun The problem you're describing here, it only happens when someone is creating a new monorepo, right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@octogonz Creating a new subspace


# Optionally provide an authentication token for the above registry URL (if it is a private registry):
# //registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}
Expand Down
Loading