chore(release): stop mutating global registry config in local-registry#5922
Merged
Coly010 merged 1 commit intoJul 22, 2026
Merged
Conversation
The local Verdaccio helper redirected the global npm and pnpm registry config to localhost:4873 on startup and restored it in a SIGINT/SIGTERM handler. That restore had holes — the verdaccio-crash path exited without restoring, SIGHUP (closed terminal) wasn't handled, and a partial failure only printed a warning — leaving developers' machines pointed at a dead localhost registry. pnpm made this worse by persisting the override in its own global auth.ini rather than ~/.npmrc, where nobody looks. The redirect was also unnecessary: local-release.ts already passes --registry explicitly to every publish command and writes a scoped .npmrc with the auth token into its temp publish dir, and the suggested npx/npm smoke-test commands carry the flag too. Drop the global set/restore entirely so there is no cleanup left to get wrong, and handle SIGHUP so closing the terminal still kills verdaccio. Update CONTRIBUTING.md to match and replace the stale troubleshooting row with one that helps recover from the override left behind by older versions of the script. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@61143e314e4196b650ab454e5af0838e7a8411dePreview package for commit |
kanadgupta
marked this pull request as draft
July 21, 2026 22:49
kanadgupta
marked this pull request as ready for review
July 22, 2026 00:10
Coly010
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
pnpm local-registry(the local Verdaccio helper for release testing) no longer redirects the globalnpmandpnpmregistry config tolocalhost:4873on startup, and no longer needs to restore it on shutdown. The cleanup handler now just kills Verdaccio, and additionally handlesSIGHUPso closing the terminal window doesn't orphan the server.CONTRIBUTING.mdis updated to match, and the troubleshooting table now covers recovering from the stale override left behind by older versions of the script.Why
The restore path had holes that could leave a developer's machine pointed at a dead localhost registry, making every subsequent
pnpm ifail:process.exit(1)without restoring the registry.SIGHUP(closing the terminal) wasn't handled, so no cleanup ran at all.This bit for real: pnpm persists the override in its own global config (
~/Library/Preferences/pnpm/auth.inion macOS) rather than~/.npmrc, so an~/.npmrc-focused manual cleanup makes npm look healthy while pnpm silently keeps resolving fromlocalhost:4873.The global redirect was also unnecessary:
local-release.tsalready passes--registryexplicitly to every publish command and writes a scoped.npmrc(with the auth token) into its temp publish dir, and the suggestednpx/npm install -gsmoke-test commands carry the flag too. With the redirect gone, there is no cleanup left to get wrong — a crash or hard kill can no longer corrupt the developer's registry config.🤖 Generated with Claude Code