Skip to content

fix: respect user's npm registry configuration in update check#2038

Open
serhiizghama wants to merge 1 commit into
ChromeDevTools:mainfrom
serhiizghama:fix/respect-npm-registry-config
Open

fix: respect user's npm registry configuration in update check#2038
serhiizghama wants to merge 1 commit into
ChromeDevTools:mainfrom
serhiizghama:fix/respect-npm-registry-config

Conversation

@serhiizghama
Copy link
Copy Markdown

Problem

The startup update check in src/bin/check-latest-version.ts hardcodes https://registry.npmjs.org/chrome-devtools-mcp/latest. Users behind corporate proxies or on a private registry (e.g. JFrog Artifactory) cannot reach that URL — the request silently fails on every startup, and they lose update notifications unless they set CHROME_DEVTOOLS_MCP_NO_UPDATE_CHECKS=1.

Fixes #1943.

The earlier discussion on that issue surfaced two competing approaches:

  • Reading only npm_config_registry. The maintainer pointed out this only covers npx / npm run invocations, not direct CLI use.
  • Pulling in @npmcli/config. Solves all cases but adds a runtime dependency.

This PR uses a third approach suggested in the issue: shell out to npm config get registry. That command:

  • Honors .npmrc files at every scope (global, user, project) and respects npm_config_registry.
  • Works the same regardless of how the CLI is invoked (direct, npx, npm run).
  • Adds no new dependency.
  • Runs at most once per 24 hours from a detached process, so the shell-out cost is negligible.

Solution

Add a small getRegistry() helper that runs npm config get registry with a 5 s timeout and validates the result before using it. Fall back to the hardcoded public registry when:

  • npm is not on PATH,
  • the command times out or errors,
  • the value is empty, "undefined", or not an http(s) URL.

The fetch URL is then composed from that resolved registry.

Testing

  • npm run typecheck — passes
  • npm run check-format — passes
  • npm run build — passes
  • node --test build/tests/check-for-updates.test.js — 6/6 pass (no regressions in the existing test suite for this area)
  • Manual: ran node build/src/bin/check-latest-version.js /tmp/out.json against the public registry → wrote {"version":"0.25.0"}. Re-ran with npm_config_registry=https://example.com → fetch fails silently as expected, no cache written.

(Unrelated E2E browser tests in tests/e2e/chrome-devtools-commands.test.js fail in my local environment; they appear environment-dependent and are not touched by this change.)

Use 'npm config get registry' to resolve the registry URL instead of
hardcoding registry.npmjs.org. This honors .npmrc files at every scope
(global, user, project) plus npm_config_registry, so update checks work
behind corporate proxies and private registries regardless of whether
the CLI was invoked directly, via npx, or via an npm script.

Falls back to the public registry when npm is unavailable or returns an
unusable value.

Fixes ChromeDevTools#1943
@OrKoN OrKoN requested a review from mathiasbynens May 12, 2026 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update check hardcodes registry.npmjs.org, ignoring user's npm registry configuration

2 participants