install: honor .npmrc //host/:_authToken= for tarballs on a different host than the registry - #34329
Closed
robobun wants to merge 5 commits into
Closed
install: honor .npmrc //host/:_authToken= for tarballs on a different host than the registry#34329robobun wants to merge 5 commits into
robobun wants to merge 5 commits into
Claude / Claude Code Review
completed
Jul 16, 2026 in 15m 29s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/ini/lib.rs:1746-1766 |
Stale tarball_url_auth entry survives across multi-file .npmrc loads |
Annotations
Check warning on line 1766 in src/ini/lib.rs
claude / Claude Code Review
Stale tarball_url_auth entry survives across multi-file .npmrc loads
nit: `install.tarball_url_auth` is only appended to inside the `!matched_any_registry` block and never cleared, so an entry pushed while processing the *global* .npmrc can go stale when the *project* .npmrc later introduces a scoped registry at that same host with a different token. A direct-URL tarball or cross-origin `dist.tarball` at that host would then send the global-file token where npm's project-over-global merge would send the project one. Very narrow (multi-file .npmrc + differing toke
Loading