SPFx 1.23 Migration: Workaround when M365 CLI installation is blocked

[shirishmawande]

While working on an SPFx 1.23 migration, I ran into an issue installing the Microsoft 365 CLI (@pnp/cli-microsoft365) package. The installation was failing because a transitive dependency (protobufjs@7.5.4) could not be downloaded from our enterprise package registry and was returning a 403 error.

Since the SPFx upgrade guidance recommends using the M365 CLI upgrade commands, I wanted to share the approach that eventually worked for me and see if others have encountered similar issues.

What I Tried

• Created a temporary Node.js workspace by creating folder in C drive
• Ran npm init -y.
• Updated required dependency overrides in package.json.
• Installed dependencies and attempted to use npm link.
• Tried overriding the vulnerable transitive dependency.

Unfortunately, this approach did not resolve the installation issue.

What Worked

• Cloned the Microsoft 365 CLI (@pnp/cli-microsoft365) repository locally.
• Identified the dependency causing the installation failure.
• Updated/overrode the affected dependency to an approved version.
• Built the CLI locally.
• Used npm link to expose the local build globally.

After that, I was able to use the M365 CLI commands and continue the SPFx 1.23 migration.

Question

Has anyone else encountered similar dependency restrictions while installing the M365 CLI during SPFx migrations?

Are there alternative approaches or recommended practices for handling this scenario?