Skip to content

Conversation

aczekajski
Copy link
Contributor

This solves problem described in #8335 in a backwards-compatible way.

This PR adds possibility to have env var replacements in .npmrc configs written as ${VAR?} which will cause them to get replaced with an empty string if the variable is not defined. Old behavior where undefined variables are left unreplaced is not changed.

References

Fixes #8335

@aczekajski aczekajski requested a review from a team as a code owner June 12, 2025 13:00
@aczekajski aczekajski changed the title feat: add suppor for optional env var replacements in .npmrc feat: add support for optional env var replacements in .npmrc Jun 12, 2025
@wraithgar
Copy link
Member

I know linting checks for this but I also manually validated via https://devina.io/redos-checker

redos check for new regex changes showing there is no redos vulnerability

@owlstronaut owlstronaut self-assigned this Jul 1, 2025
Copy link
Contributor

@owlstronaut owlstronaut left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like a great feature! Just a couple nits

@alexsch01
Copy link
Contributor

@aczekajski any update on this PR? thank you for your work on it

@aczekajski
Copy link
Contributor Author

@alexsch01 I completely forgot about the change suggestions waiting for my action, sorry. Gonna have a look at them soon! Thank you for the reminder ^^

aczekajski and others added 3 commits September 3, 2025 22:43
Co-authored-by: Michael Smith <[email protected]>
Co-authored-by: Michael Smith <[email protected]>
Co-authored-by: Michael Smith <[email protected]>
@aczekajski
Copy link
Contributor Author

@alexsch01 @owlstronaut I commited the suggested changes so I believe the PR is ready for review.

@owlstronaut owlstronaut merged commit bdcc10d into npm:latest Sep 3, 2025
21 checks passed
@github-actions github-actions bot mentioned this pull request Sep 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[BUG] Impossible to reliably passthrough NODE_OPTIONS in .npmrc
5 participants