fix!: Preserve https protocol when working with git by oldium · Pull Request #8703 · npm/cli

oldium · 2025-10-27T12:10:21Z

This prevents changing URLs from https and git+https into git+ssh, but keeps the fall-back to git+ssh when the protocol is not specified.

The change in pacote is necessary in order to have this fully working.

References

Supersedes #5256
Blocked by npm/pacote#434
Fixes#4305
Fixes#2610

oldium · 2025-10-27T13:17:00Z

Hm. Tests work fine, but in reality, nothing changed (package-lock.json contains git+ssh link), possibly same as in #5256. Investigating...

oldium · 2025-10-27T14:28:24Z

It seems also https://github.com/npm/pacote needs the same fix

oldium · 2025-10-27T14:58:22Z

The pacote really needs fixing, after the fix the package-lock.json contains git+https link instead of git+ssh, but still the github:repo/project is recorded in dependencies, which is not equivalent (resolves to git+ssh). Almost there... 😁

When the URL explicitly contains https, do not try to switch to ssh. This change is necessary for [npm][3] to retain the protocol, please see the link and the referenced issues [here][1] and [here][2] reporting problems when using ssh instead of requested https. [1]: npm/cli#2610 [2]: npm/cli#4305 [3]: npm/cli#8703 Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

oldium · 2025-10-27T15:55:53Z

Fixed, tested, should work now. The fix in pacote is necessary to have this really fully working.

When the URL explicitly contains https, do not try to switch to ssh. This change is necessary for [npm][3] to retain the protocol, please see the link and the referenced issues [here][1] and [here][2] reporting problems when using ssh instead of requested https. [1]: npm/cli#2610 [2]: npm/cli#4305 [3]: npm/cli#8703 Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

oldium · 2026-01-18T10:48:27Z

Rebased to latest

BREAKING CHANGE: git specs using the `https` or `git+https` protocol now resolve to `git+https` URLs instead of being switched to `git+ssh`. Shortcut specs (e.g. `github:user/repo`, `user/repo`) and `git+ssh`/`git://` specs are unchanged. When the URL explicitly contains https, do not try to switch to ssh. This change is necessary for [npm][3] to retain the protocol, please see the link and the referenced issues [here][1] and [here][2] reporting problems when using ssh instead of requested https. [1]: npm/cli#2610 [2]: npm/cli#4305 [3]: npm/cli#8703 ## References Relates to npm/cli#8703 Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

owlstronaut · 2026-04-29T18:03:23Z

Hello @oldium ! I'm working on getting this guy in for npm@12. Do you want to bring it up to date?

oldium · 2026-04-29T22:15:13Z

I see there is a new version of pacote, so sure, I will rebase. Thanks for letting me know.

oldium · 2026-05-01T11:53:20Z

I tried to rebase, but the release of pacote v22.0.0 is not yet finished. I can add the pacote update into this PR when the release is made.

owlstronaut · 2026-05-01T16:13:02Z

Ah gotcha. We are going to be bumping engines once the new nodejs comes out, should be Tuesday. Then I'll start hitting all the releases that need to happen so should be soon then

oldium · 2026-05-01T19:41:46Z

Rebased to latest, tested with pacote update and https is preserved - tested with the tree here https://github.com/oldium/npm-cli/commits/fix/git-https-full/. The pacote library is used internally inside workspaces (easy to upgrade), but also as external @npmcli/metavuln-calculator library.

So merging this is one step towards having this fixed finally. Update of pacote is the last missing piece.

owlstronaut · 2026-06-18T15:57:27Z

@oldium Sorry that took so long, it is a big coordinated effort to get the supported engine versions bumped throughout the project. We should be able to see this work with a rebase!

oldium · 2026-06-18T19:27:47Z

@oldium Sorry that took so long, it is a big coordinated effort to get the supported engine versions bumped throughout the project. We should be able to see this work with a rebase!

Sure, happy to rebase. Give me a day, will do it :-)

This prevents changing URLs from https and git+https into git+ssh, but keeps the fall-back to git+ssh when the protocol is not specified. Supersedes npm#5256Fixesnpm#4305Fixesnpm#2610 Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

oldium · 2026-06-19T09:40:39Z

Rebased, Linux tests are passing (running test suite on Windows fails, unrelated to this work).

Local test with npm i --allow-git=all https://github.com/bgub/eta#main on my project passed.

Before (github: prefix is actually a git+ssh alias):

diff --git a/package-lock.json b/package-lock.json
index 3476549..6d53e33 100644
--- a/package-lock.json+++ b/package-lock.json@@ -16,7 +16,7 @@
"dotenv": "^17.4.2",
"entities": "^8.0.0",
"escape-html": "^1.0.3",
- "eta": "^4.6.0",+ "eta": "github:bgub/eta#main",
"etag": "^1.8.1",
"express": "^5.2.1",
"fast-glob": "^3.3.3",
@@ -5504,8 +5504,7 @@
},
"node_modules/eta": {
"version": "4.6.0",
- "resolved": "https://registry.npmjs.org/eta/-/eta-4.6.0.tgz",- "integrity": "sha512-lW6is4T1NFOYnmqGZIfvixqj7A7sSvScF+DN8EK6K58xI5MZ5UvYe0GjopxOXQtZvUn4eDdVuZ8XSoYWTMEKwA==",+ "resolved": "git+ssh://git@github.com/bgub/eta.git#7e8b40362151cc41d114bdf4ba78336949c94260",
"license": "MIT",
"engines": {
"node": ">=20"

After (https preserved in all places):

diff --git a/package-lock.json b/package-lock.json
index 3476549..adb85d6 100644
--- a/package-lock.json+++ b/package-lock.json@@ -16,7 +16,7 @@
"dotenv": "^17.4.2",
"entities": "^8.0.0",
"escape-html": "^1.0.3",
- "eta": "^4.6.0",+ "eta": "git+https://github.com/bgub/eta.git#main",
"etag": "^1.8.1",
"express": "^5.2.1",
"fast-glob": "^3.3.3",
@@ -5504,8 +5504,7 @@
},
"node_modules/eta": {
"version": "4.6.0",
- "resolved": "https://registry.npmjs.org/eta/-/eta-4.6.0.tgz",- "integrity": "sha512-lW6is4T1NFOYnmqGZIfvixqj7A7sSvScF+DN8EK6K58xI5MZ5UvYe0GjopxOXQtZvUn4eDdVuZ8XSoYWTMEKwA==",+ "resolved": "git+https://github.com/bgub/eta.git#7e8b40362151cc41d114bdf4ba78336949c94260",
"license": "MIT",
"engines": {
"node": ">=20"

owlstronaut · 2026-06-19T14:23:49Z

Thank you for sticking with this @oldium ! Appreciate you!

oldium requested a review from a team as a code owner October 27, 2025 12:10

This was referenced Oct 27, 2025
[BUG] NPM v7 uses SSH instead of an explicit HTTPS for GitHub repos #2610
Closed
[BUG] git+https protocol not respected when generating package-lock.json #4305
Closed

oldium changed the title ~~bugfix: Preserve https protocol when working with git~~WIP bugfix: Preserve https protocol when working with gitOct 27, 2025

oldium force-pushed the fix/git-https branch 2 times, most recently from 675a3c8 to a2ceccdCompare October 27, 2025 15:23

oldium mentioned this pull request Oct 27, 2025
fix!: do not switch to git+ssh for https repository links npm/pacote#434
Merged

oldium changed the title ~~WIP bugfix: Preserve https protocol when working with git~~bugfix: Preserve https protocol when working with gitOct 27, 2025

This comment was marked as outdated.
Sign in to view

oldium force-pushed the fix/git-https branch from a2ceccd to a142a53Compare November 12, 2025 09:58

wraithgar changed the title ~~bugfix: Preserve https protocol when working with git~~fix: Preserve https protocol when working with gitNov 13, 2025

oldium force-pushed the fix/git-https branch from a142a53 to be79162Compare November 15, 2025 19:54

oldium force-pushed the fix/git-https branch from be79162 to bac0acaCompare November 22, 2025 21:50

oldium force-pushed the fix/git-https branch from bac0aca to 3e95c27Compare December 10, 2025 18:39

oldium force-pushed the fix/git-https branch from 3e95c27 to 0379fbaCompare January 18, 2026 10:47

oldium force-pushed the fix/git-https branch from 0379fba to 2ac24eeCompare January 22, 2026 22:44

owlstronaut mentioned this pull request Apr 29, 2026
don't force git+ssh if https specified npm/statusboard#1081
Closed

owlstronaut changed the title ~~fix: Preserve https protocol when working with git~~fix!: Preserve https protocol when working with gitApr 29, 2026

oldium force-pushed the fix/git-https branch from 2ac24ee to b11dde0Compare May 1, 2026 19:36

oldium force-pushed the fix/git-https branch from b11dde0 to c3b5c95Compare June 19, 2026 08:18

oldium requested a review from a team as a code owner June 19, 2026 08:18

owlstronaut approved these changes Jun 19, 2026
View reviewed changes

owlstronaut merged commit e96a7de into npm:latestJun 19, 2026
45 checks passed

github-actionsBot mentioned this pull request Jun 19, 2026
chore: release 12.0.0-pre.1 #9387
Merged

npm-cli-bot mentioned this pull request Jun 23, 2026
deps: upgrade npm to 12.0.0-pre.1 nodejs/node#64096
Closed

github-actionsBot mentioned this pull request Jul 8, 2026
chore: release 12.0.0 #9736
Merged

npm-cli-bot mentioned this pull request Jul 31, 2026
deps: upgrade npm to 12.0.2 nodejs/node#64882
Closed

coderabbitaiBot mentioned this pull request Aug 9, 2026
chore(deps): Update dependencies and upgrade uuid FireRat666/Etcher-Privacy#9
Closed

Uh oh!

Conversation

oldium commented Oct 27, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

References

Uh oh!

oldium commented Oct 27, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oldium commented Oct 27, 2025

Uh oh!

oldium commented Oct 27, 2025

Uh oh!

oldium commented Oct 27, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

oldium commented Jan 18, 2026

Uh oh!

owlstronaut commented Apr 29, 2026

Uh oh!

oldium commented Apr 29, 2026

Uh oh!

oldium commented May 1, 2026

Uh oh!

owlstronaut commented May 1, 2026

Uh oh!

oldium commented May 1, 2026

Uh oh!

owlstronaut commented Jun 18, 2026

Uh oh!

oldium commented Jun 18, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oldium commented Jun 19, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

owlstronaut commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

oldium commented Oct 27, 2025•
edited
Loading

oldium commented Oct 27, 2025•
edited
Loading

oldium commented Oct 27, 2025•
edited
Loading

oldium commented Jun 18, 2026•
edited
Loading

oldium commented Jun 19, 2026•
edited
Loading