From 342a18d2af95bcdae1a6b1de27e16360626fe3d4 Mon Sep 17 00:00:00 2001 From: s-stumbo Date: Fri, 15 May 2026 15:30:04 -0400 Subject: [PATCH] Update GAR guidance for JS Signed-off-by: s-stumbo --- content/chainguard/libraries/javascript/global-configuration.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/chainguard/libraries/javascript/global-configuration.md b/content/chainguard/libraries/javascript/global-configuration.md index 3ada09acf3..d90c02415b 100644 --- a/content/chainguard/libraries/javascript/global-configuration.md +++ b/content/chainguard/libraries/javascript/global-configuration.md @@ -370,3 +370,5 @@ Google Artifact Registry (GAR) is not an officially supported repository manager Configure two GAR remote repositories, with upstream validation disabled on the second: * First remote repository: `javascript-chainguard` pointing to `https://libraries.cgr.dev/javascript` with upstream validation enabled * Second remote repository: `javascript-chainguard-upstream` pointing to `https://libraries.cgr.dev/javascript-upstream` with upstream validation disabled. + +When using `artifactregistry-auth`, note that it only injects credentials for repositories explicitly listed in your `.npmrc`. Ensure you add a credentials entry for the `javascript-chainguard-upstream` repository alongside your existing `javascript-chainguard` entry, otherwise you will receive 404s for upstream-fallback packages. \ No newline at end of file