From 4b7801166a154cfe8d555c808897cbd407521fc5 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 2 Nov 2026 21:01:26 +0000 Subject: [PATCH] Upgrade notes: npm and Yarn password logins follow the local realm's client-password setting In 2.1 the npm password login (`yarn npm login`, `npm login --auth-type=legacy`) walked every realm whatever `allow_password_basic` said. Since #647 it goes through the realms that accept client passwords (`PasswordFrom::Client`), and migration 0006 sets the local realm's setting from `allow_password_basic`, off by default. On such an install these logins answer 401 for every local account after the upgrade. 647.upgrade.md describes the change only for installs with a credential-forwarding realm, so the operators it hits read that nothing changes for them. A fragment of its own says so, and names the remedies: the local realm's setting, the browser login, or a token. Fixes #793 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012e6DJc1H3748D8sheqhKTV --- docs/changes/2.2.0/793.upgrade.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 docs/changes/2.2.0/793.upgrade.md diff --git a/docs/changes/2.2.0/793.upgrade.md b/docs/changes/2.2.0/793.upgrade.md new file mode 100644 index 00000000..69ad658d --- /dev/null +++ b/docs/changes/2.2.0/793.upgrade.md @@ -0,0 +1,9 @@ +`yarn npm login` (Yarn 2+) and `npm login --auth-type=legacy` take a local +account's password only while the local realm's **Accept passwords from +clients (HTTP Basic)** is on, as the feeds do. In 2.1 these logins took it +whatever `allow_password_basic` said. The upgrade sets the local realm's +setting from `allow_password_basic`, which was off by default, so on such an +install these logins answer 401 for every local account after the upgrade; +accounts of a credential-forwarding realm sign in as before. Turn the +setting on for the local realm under **Admin → Authentication**, or sign npm +in with the browser (`npm login`) or a token from the web UI.