Skip to content

Commit 48f90f5

Browse files
committed
fix(@angular/cli): prevent Yarn registry environment variable override
When running scripts via Yarn Classic (such as yarn ng update), Yarn automatically injects npm_config_registry=https://registry.yarnpkg.com into the child process environment. When the PackageManager abstraction spawns child CLI subprocesses (such as yarn info), those child processes inherit the injected registry environment variable. Because environment variables take highest precedence, this previously caused spawned subprocesses to ignore local .yarnrc files and query the public CDN mirror. Strip npm_config_registry and NPM_CONFIG_REGISTRY from the child process environment when running under Yarn so that spawned subprocesses correctly respect local repository registry settings.
1 parent c7c8047 commit 48f90f5

1 file changed

Lines changed: 22 additions & 7 deletions

File tree

  • packages/angular/cli/src/package-managers

packages/angular/cli/src/package-managers/host.ts

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -129,18 +129,33 @@ export const NodeJS_HOST: Host = {
129129
const isWin32 = platform() === 'win32';
130130

131131
return new Promise((resolve, reject) => {
132+
const env: Record<string, string | undefined> = {
133+
...process.env,
134+
...options.env,
135+
// NPM updater notifier will prevents the child process from closing until it timeout after 3 minutes.
136+
NO_UPDATE_NOTIFIER: '1',
137+
NPM_CONFIG_UPDATE_NOTIFIER: 'false',
138+
};
139+
140+
// When running via Yarn Classic (`yarn run <script>`), Yarn automatically injects
141+
// `npm_config_registry=https://registry.yarnpkg.com` into the environment.
142+
// Strip this fallback so that spawned child processes correctly respect local `.npmrc`/`.yarnrc` files.
143+
if (
144+
(env['npm_config_registry'] === 'https://registry.yarnpkg.com' ||
145+
env['NPM_CONFIG_REGISTRY'] === 'https://registry.yarnpkg.com') &&
146+
(env['npm_config_user_agent']?.includes('yarn') ||
147+
env['NPM_CONFIG_USER_AGENT']?.includes('yarn'))
148+
) {
149+
delete env['npm_config_registry'];
150+
delete env['NPM_CONFIG_REGISTRY'];
151+
}
152+
132153
const spawnOptions = {
133154
shell: isWin32,
134155
stdio: options.stdio ?? 'pipe',
135156
signal,
136157
cwd: options.cwd,
137-
env: {
138-
...process.env,
139-
...options.env,
140-
// NPM updater notifier will prevents the child process from closing until it timeout after 3 minutes.
141-
NO_UPDATE_NOTIFIER: '1',
142-
NPM_CONFIG_UPDATE_NOTIFIER: 'false',
143-
},
158+
env,
144159
} satisfies SpawnOptions;
145160
const childProcess = isWin32
146161
? spawn(`${command} ${args.join(' ')}`, spawnOptions)

0 commit comments

Comments
 (0)