fix(@angular/cli): remove forceAuth and unscoped credential parsing

clydin · clydin · commit f8c3df4e29d8 · 2026-06-10T09:51:56.000-04:00
Remove the non-standard forceAuth option and custom parsing for unscoped registry
credentials (token, username, password, auth) in package-metadata.ts.

Since the npm CLI does not support unscoped credentials and ignores them by
default, this aligning removes the unnecessary parsing complexity. Unscoped
credentials will now behave identically to any other standard configuration
property, falling through to default configuration parsing.
diff --git a/packages/angular/cli/src/utilities/package-metadata.ts b/packages/angular/cli/src/utilities/package-metadata.ts
@@ -52,9 +52,7 @@ export interface PackageManifest extends Manifest, NgPackageManifestProperties {
   peerDependenciesMeta?: Record<string, { optional?: boolean }>;
 }
 
-interface PackageManagerOptions extends Record<string, unknown> {
-  forceAuth?: Record<string, unknown>;
-}
+type PackageManagerOptions = Record<string, unknown>;
 
 let npmrc: PackageManagerOptions;
 const npmPackageJsonCache = new Map<string, Promise<Partial<NpmRepositoryPackageJson>>>();
@@ -175,19 +173,6 @@ function normalizeOptions(
     }
 
     switch (key) {
-      // Unless auth options are scope with the registry url it appears that npm-registry-fetch ignores them,
-      // even though they are documented.
-      // https://github.com/npm/npm-registry-fetch/blob/8954f61d8d703e5eb7f3d93c9b40488f8b1b62ac/README.md
-      // https://github.com/npm/npm-registry-fetch/blob/8954f61d8d703e5eb7f3d93c9b40488f8b1b62ac/auth.js#L45-L91
-      case '_authToken':
-      case 'token':
-      case 'username':
-      case 'password':
-      case '_auth':
-      case 'auth':
-        options['forceAuth'] ??= {};
-        options['forceAuth'][key] = substitutedValue;
-        break;
       case 'noproxy':
       case 'no-proxy':
         options['noProxy'] = substitutedValue;
