fix(publish): authenticate the package existence check so private packages work - #36656
Merged
Merged
Conversation
…kages work The registry responds with a 404 for a private package unless the request is authenticated as someone with access to it. `deno publish` checked whether packages exist before obtaining auth headers and without sending any authorization, so publishing to an existing private package misreported it as missing: the CLI directed the user to the package creation page and then polled the (still unauthenticated) package endpoint forever. Obtain the auth headers first, and send the per-package authorization on the existence check and on the creation poll loop.
bartlomieju
approved these changes
Aug 24, 2026
…s-publish # Conflicts: # cli/registry.rs # cli/tools/publish/mod.rs
crowlKats
enabled auto-merge (squash)
August 25, 2026 22:44
bartlomieju
pushed a commit
that referenced
this pull request
Aug 27, 2026
…kages work (#36656) The registry responds with a 404 for a private package unless the request is authenticated as someone with access to it (jsr-io/jsr#1270). `deno publish` checked whether packages exist before obtaining auth headers and without sending any authorization, so publishing to an existing private package misreported it as missing: the CLI directed the user to the package creation page and then polled the (still unauthenticated) package endpoint forever. This obtains the auth headers first, and sends the per-package authorization on the existence check and on the creation poll loop. For public packages nothing changes except the order of the auth prompt relative to the missing-package prompt. The early already-published version probe (`check_version_exists`) intentionally stays unauthenticated: it fails open, and a private package's already-published version is caught by the existing `duplicateVersionPublish` handling during the publish itself. Required for jsr-io/jsr#1270 (private packages).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The registry responds with a 404 for a private package unless the request is authenticated as someone with access to it (jsr-io/jsr#1270).
deno publishchecked whether packages exist before obtaining auth headers and without sending any authorization, so publishing to an existing private package misreported it as missing: the CLI directed the user to the package creation page and then polled the (still unauthenticated) package endpoint forever.This obtains the auth headers first, and sends the per-package authorization on the existence check and on the creation poll loop. For public packages nothing changes except the order of the auth prompt relative to the missing-package prompt.
The early already-published version probe (
check_version_exists) intentionally stays unauthenticated: it fails open, and a private package's already-published version is caught by the existingduplicateVersionPublishhandling during the publish itself.Required for jsr-io/jsr#1270 (private packages).