fix: correct bundled sigstore from dev dependency conflict by james-pre · Pull Request #9740 · npm/cli

james-pre · 2026-07-09T15:20:10Z

This PR fixes #9722.

mock-registry pinned @npmcli/arborist@^9.1.2, which meant the local workspace version wasn't linked and the dependency was pulled from the registry instead. sigstore@^4 got installed at the root node_modules and ^5 was put into workspaces/libnpmpublish/node_modules. The dev-only ^4 was then excluded when npm was packed.

Fix:

mock-registry: arborist ^9.1.2 -> ^10.0.0
workspaces/arborist: validate-npm-package-name ^7.0.2 -> ^8.0.0 (need to release a patch for arborist)
Lockfile regenerated via install + dedupe; node . run dependencies

The packed tarball now contains package/node_modules/sigstore and publish --dry-run from the extracted tarball succeeds.

reggi · 2026-07-10T14:57:12Z

Thanks for your help on this, we need a check to make sure this doesn't happen again 😢

…ug (#275, #186) (#277) Create the tauri-action release as a draft; add a promote job (needs: build) that flips it public only once every matrix leg has uploaded, so `latest` can never resolve to a partial release. publish-npm now waits on promote (not just build), since GitHub won't serve assets off a draft release to anonymous downloads and the npm launcher fetches them at runtime. Un-pin npm past npm@^11: npm/cli#9722 (missing sigstore, breaking provenance publish) was fixed by npm/cli#9740 and shipped in npm 12.0.1 (2026-07-10) — verified by extracting the published tarball and confirming node_modules/sigstore is bundled again. ^12.0.1 tracks future 12.x patches while excluding the broken 12.0.0.

npm 12.0.0's published bundle omitted libnpmpublish's unscoped `sigstore` dependency, so every `npm publish --provenance` in the e2e fixture job died at module load (npm/cli#9722). #438/#439 pinned `npm install -g npm@11` as a workaround, with #440 tracking the unpin. npm/cli#9740 fixed the packing bug and shipped in npm 12.0.1 (2026-07-10); the packed tarball again contains `node_modules/sigstore`. `latest` now resolves to 12.0.1. Verified locally with a fresh `npm install -g npm@latest` (→ 12.0.1) that `require.resolve('sigstore', { paths: [libnpmpublish/lib] })` resolves — the exact check that failed on 12.0.0. Kept as an explicit major (npm@12), never floating `npm@latest`, per the #438/#439 contract. The e2e fixture suite going green on this PR is the end-to-end verification. skip-changelog: CI-internal harness pin; no consumer surface Claude-Session: https://claude.ai/code/session_0131HkmhYCFEQCJ4wZcGWABJ Co-authored-by: Claude <noreply@anthropic.com>

ci: unpin e2e npm CLI from npm@11 to npm@12 (closes #440) (#535) npm 12.0.0's published bundle omitted libnpmpublish's unscoped `sigstore` dependency, so every `npm publish --provenance` in the e2e fixture job died at module load (npm/cli#9722). #438/#439 pinned `npm install -g npm@11` as a workaround, with #440 tracking the unpin. npm/cli#9740 fixed the packing bug and shipped in npm 12.0.1 (2026-07-10); the packed tarball again contains `node_modules/sigstore`. `latest` now resolves to 12.0.1. Verified locally with a fresh `npm install -g npm@latest` (→ 12.0.1) that `require.resolve('sigstore', { paths: [libnpmpublish/lib] })` resolves — the exact check that failed on 12.0.0. Kept as an explicit major (npm@12), never floating `npm@latest`, per the #438/#439 contract. The e2e fixture suite going green on this PR is the end-to-end verification. skip-changelog: CI-internal harness pin; no consumer surface Claude-Session: https://claude.ai/code/session_0131HkmhYCFEQCJ4wZcGWABJ Co-authored-by: Claude <noreply@anthropic.com>

zakatfoundationuganda0-code · 2026-07-20T22:31:07Z

VID-20260720-WA0028.mp4

…audit Compared this repo's release.yml/sync-version.mjs against the 3 sibling MCP server repos (tmdb-mcp, steam-games-mcp, mal-mcp) — each had independently invented a different subset of fixes for the same problems. Converging on the best-of-four here: - Add a hard fail-fast gate in release.yml: if CHANGELOG.md's extracted section for this version comes back empty, the workflow now errors instead of silently shipping a blank GitHub Release body. - Pin npm to an exact, verified-good version (12.0.1) before `npm publish --provenance`, instead of relying on whatever ships bundled with actions/setup-node — matches every other tool in this workflow already being pinned to an exact commit/tag. npm 12.0.0 shipped a broken provenance path (npm/cli#9722, "Cannot find module 'sigstore'"), fixed in 12.0.1 (npm/cli#9740). The existing npm-publish idempotency guard (this repo's own invention) is untouched. - Rewrite sync-version.mjs's CHANGELOG-dating logic as a pure, exported, unit-tested function (renderChangelogRelease) instead of an untested inline script — same "is [Unreleased] actually empty" bullet check as before, just extracted so it's independently testable. - scripts/sync-version.d.mts: a hand-written .d.ts for the newly exported function, needed because tsc's Node16 module resolution can't infer types across the src/ project boundary into scripts/ without one.

A re-run tag push or a manually-bootstrapped version would make npm publish hard-fail on a duplicate version and abort the job before the MCP Registry steps ever ran. Add a check-if-published step and gate the publish step on it. npm 12.0.0's provenance bug ("Cannot find module 'sigstore'", npm/cli#9722) is fixed in 12.0.1 (npm/cli#9740, released 2026-07-10), now npm's current latest — bump the pin and correct the stale comment.

…repo audit Compared this repo's release.yml/sync-version.mjs against the 3 sibling MCP server repos (steam-games-mcp, mal-mcp, anilist-mcp-server) — each had independently invented a different subset of fixes for the same problems, at different times. Converging on the best-of-four here: - Add a hard fail-fast gate in release.yml: if CHANGELOG.md's extracted section for this version comes back empty, the workflow now errors instead of silently shipping a blank GitHub Release body (mal-mcp already had this after its own 2026-07-29 incident; the other 3 repos, including this one, didn't). - Add an npm-publish idempotency guard: skip (not fail) `npm publish` if this version is already on npm, so a tag re-run doesn't abort the job before the MCP Registry publish steps run (anilist-mcp-server's own fix, otherwise unique to it). - Pin npm to an exact, verified-good version (12.0.1) instead of a stale defensive pin (11.18.0) or a floating `@latest` — matches every other tool in this workflow already being pinned to an exact commit/tag (actions/checkout, actions/setup-node, gh-release). Verified live: npm/cli#9722 (the "Cannot find module 'sigstore'" provenance bug in 12.0.0) was fixed in 12.0.1 (npm/cli#9740, 2026-07-10), which is npm's current `latest` dist-tag. - Rewrite sync-version.mjs's CHANGELOG-dating logic as a pure, exported, unit-tested function (renderChangelogRelease, mirroring mal-mcp's design) instead of an untested inline script — and make its "is [Unreleased] actually empty" check robust to stray blank lines (checks for a real `- ` bullet, per anilist-mcp-server's more careful version, instead of just "a heading immediately follows"). - scripts/sync-version.d.mts: a hand-written .d.ts for the newly exported function, needed because tsc's Node16 module resolution can't infer types across the src/ project boundary into scripts/ without one (mal-mcp already needed and has this same file).

Fix issue with bundled sigstore (npm#9722)

927db13

james-pre requested review from a team as code owners July 9, 2026 15:20

dougwithseismic mentioned this pull request Jul 9, 2026

ci(release): pin npm to 11.x — npm 12.0.0 breaks publish provenance dougwithseismic/hogsend#371

Merged

shiienurm mentioned this pull request Jul 9, 2026

Hot-fix: unblock beta publish (pin npm 11.x) + bump to 1.1.0-beta.2 mindfulteam/homebridge-unifi-webhook#3

Merged

getty104 mentioned this pull request Jul 10, 2026

fix: publishワークフローのnpmをv11にピン留めしてsigstoreバグを回避 getty104/claude-task-worker#56

Merged

reggi approved these changes Jul 10, 2026

View reviewed changes

reggi merged commit 47fc8b1 into npm:latest Jul 10, 2026
64 checks passed

github-actions Bot mentioned this pull request Jul 10, 2026

chore: release 12.0.1 #9744

Merged

This was referenced Jul 10, 2026

chore: add ci check requiring deps: commits for prod dependency changes #9748

Open

chore: assert bundled production deps resolve in the packed npm #9749

Open

yihui added a commit to yihui/lite.js that referenced this pull request Jul 11, 2026

this should be resolved in npm v12.0.1: npm/cli#9740

44367f7

agentjp mentioned this pull request Jul 13, 2026

ci: bump the npm publish pin to 12.0.1 now that provenance is fixed agentjp/bdinfo-rs#95

Merged

thekevinbot mentioned this pull request Jul 16, 2026

ci: unpin e2e npm CLI from npm@11 to npm@12 (closes #440) thekevinscott/putitoutthere#535

Merged

This was referenced Jul 20, 2026

Pin the release npm self-update to major 11 drizzle-team/drizzle-orm#6003

Merged

Pin the release npm self-update to major 11 drizzle-team/drizzle-orm#6004

Merged

npm-cli-bot mentioned this pull request Jul 31, 2026

deps: upgrade npm to 12.0.2 nodejs/node#64882

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: correct bundled sigstore from dev dependency conflict - #9740

fix: correct bundled sigstore from dev dependency conflict#9740
reggi merged 1 commit into
npm:latestfrom
james-pre:9722-missing-sigstore

james-pre commented Jul 9, 2026

Uh oh!

reggi commented Jul 10, 2026

Uh oh!

Uh oh!

zakatfoundationuganda0-code commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

james-pre commented Jul 9, 2026

Uh oh!

reggi commented Jul 10, 2026

Uh oh!

Uh oh!

zakatfoundationuganda0-code commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants