No more working under npm 12

Open Beginner friendly
#615 0 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
nodejs, typescript
Domain
tooling

Research direction

Start in src/makePatch.ts at the two npm command locations around lines 234 and 242, and review how their stdio and arguments are configured. Reproduce the failure with npm 12 using the reported npx patch-package command, then verify both installation paths succeed without EALLOWREMOTE after the change.

Written by the indexing model from the issue text.

Description

Issue

Running npx patch-package ... under npm 12 will now produce the following error:

npx patch-package nx
npm notice run npx
npm notice run 'patch-package' nx
patch-package 8.0.1
• Creating temporary folder
• Installing nx@22.7.5 with npm
{
  status: 1,
  signal: null,
  output: [ null, null, null ],
  pid: 81284,
  stdout: null,
  stderr: null,
  error: null
}

/Users/xyz/node_modules/patch-package/dist/makePatch.js:395
        throw e;
        ^
{
  status: 1,
  signal: null,
  output: [ null, null, null ],
  pid: 81284,
  stdout: null,
  stderr: null,
  error: null
}

Node.js v24.18.0
Explanation

Changing stdio to inherit here:
https://github.com/ds300/patch-package/blob/be4dfd77d941c0e6fb56b60843f3a98fd1d7ba4c/src/makePatch.ts#L239-L246

will now gives better hint on the issue:

• Installing nx@22.7.5 with npm
npm warn using --force Recommended protections disabled.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "nx@https://registry.npmjs.org/nx/-/nx-22.7.5.tgz"
npm error A complete log of this run can be found in: /Users/xyz/.npm/_logs/2026-08-02T00_31_48_537Z-debug-0.log

Npm 12 now set allow-remote=none by default, which blocks any background installations trying to download direct tarballs (.tgz files) from an absolute remote URL, even if it points to the official registry.

Temporary solution

Use the following:

npm_config_allow_remote=all npx patch-package ...
Fix

Add the argument --allow-remote=all to both npm commands:

Dominant language
TypeScript
Stars
11.2k
Forks
325
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ds300/patch-package

All issues in ds300/patch-package

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.