fix: install nRF Cloud libraries from NPM instead of JSR - #68
Merged
Conversation
These libraries are published to NPM now, so consume them as ordinary registry dependencies instead of through JSR's NPM compatibility layer (`npm:@jsr/nrfcloud__…`). The versions are pinned explicitly, without a caret. This also removes `@jsr:registry` and `allow-remote` from `.npmrc`. Nothing is installed from JSR anymore, and `allow-remote` only existed to permit JSR's remote tarball URLs, which NPM v12 blocks by default. Keeping it would leave remote tarball fetches enabled for every dependency in the tree for no reason.
coderbyheart
force-pushed
the
fix/deps-from-npm
branch
from
August 5, 2026 12:42
6db1195 to
8a0d92d
Compare
Member
Author
|
Security fix, no review required. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consumes the nRF Cloud helper libraries from NPM instead of JSR, now that they
are published to NPM.
What changed
npm:@jsr/nrfcloud__…aliases are replaced with plain NPM dependencies,pinned to explicit versions without a caret.
@jsr:registry=https://npm.jsr.iois removed from.npmrc— nothing isinstalled from JSR anymore.
allow-remoteis removed from.npmrcas well. It only existed to permitJSR's remote tarball URLs, which NPM v12 blocks by default. Leaving it in
place would keep remote tarball fetches enabled for every dependency in the
tree for no reason. There are no remaining dependencies on remote URLs — the
only other
npm:aliases are the TypeScript ones, which resolve from theregistry and do not need it. With both settings gone the file has no content
left, so it is deleted.
Verified locally
npm installfrom a clean slate (nonode_modules, no lock file, no.npmrc)resolves everything from
registry.npmjs.org,npm cithen reinstalls from theregenerated lock file, and the type check, tests and build all pass.
Release order
This has to be released before the applications that consume this package
can drop
@jsr:registryfrom their own.npmrc. The currently publishedversions still carry the JSR aliases in their metadata, which forces every
consumer to keep a
@jsrregistry mapping configured.