From e1581be90119391cc1093db8a301439bf0e7808f Mon Sep 17 00:00:00 2001
From: Tea Reggi <reggi@github.com>
Date: Thu, 24 Sep 2026 17:47:11 -0400
Subject: [PATCH 1/2] chore(config): isolate tests from host npmrc files
 (#10015)

## Summary

Prevent @npmcli/config tests from reading npmrc files from the developer
machine.

The test filesystem mock now treats the system npmrc, Node installation
npmrc, and user npmrc as absent while continuing to load explicit test
fixtures.

## Testing

`npm test --workspace @npmcli/config`

Copilot-Session: d4d3278e-3e07-4181-b096-60fbdd86c341
---
 workspaces/config/test/index.js | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/workspaces/config/test/index.js b/workspaces/config/test/index.js
index 60941c7760985..ad0355000df47 100644
--- a/workspaces/config/test/index.js
+++ b/workspaces/config/test/index.js
@@ -2,6 +2,8 @@ const t = require('tap')
 
 const fs = require('node:fs')
 const { readFileSync } = fs
+const { homedir } = require('node:os')
+const { resolve, join, dirname } = require('node:path')
 
 // when running with `npm test` it adds environment variables that
 // mess with the things we expect here, so delete all of those.
@@ -16,11 +18,28 @@ const createDef = (key, value) => ({ [key]: new Definition(key, { key, ...value
 
 const typeDefs = require('../lib/type-defs.js')
 
-const { resolve, join, dirname } = require('node:path')
+const nodePrefix = process.platform === 'win32'
+  ? dirname(process.execPath)
+  : dirname(dirname(process.execPath))
+const externalNpmrcs = new Set([
+  resolve('/etc/npmrc'),
+  resolve(nodePrefix, 'etc/npmrc'),
+  resolve(homedir(), '.npmrc'),
+])
+const throwIfExternalNpmrc = path => {
+  if (typeof path === 'string' && externalNpmrcs.has(resolve(path))) {
+    throw Object.assign(new Error(`ENOENT: no such file or directory, open '${path}'`), {
+      code: 'ENOENT',
+      path,
+      syscall: 'open',
+    })
+  }
+}
 
 const mockFs = {
   ...fs,
   readFileSync: (path, ...args) => {
+    throwIfExternalNpmrc(path)
     if (path.includes('WEIRD-ERROR')) {
       throw Object.assign(new Error('weird error'), { code: 'EWEIRD' })
     }
@@ -32,6 +51,7 @@ const mockFs = {
 const mockFsPromises = {
   ...fs.promises,
   readFile: async (path, ...args) => {
+    throwIfExternalNpmrc(path)
     if (path.includes('WEIRD-ERROR')) {
       throw Object.assign(new Error('weird error'), { code: 'EWEIRD' })
     }

From 0c3b82a9a612c3f9399d35c28c86708b1f8ea7d4 Mon Sep 17 00:00:00 2001
From: sam crochet <shmam@github.com>
Date: Thu, 24 Sep 2026 16:44:33 -0700
Subject: [PATCH 2/2] docs: update npm stage docs to reflect that it can create
 new packages (#10017)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

The `npm stage` **Prerequisites** section states that the package must
already exist on the npm registry. Staged publishing will soon support
**creating brand-new packages** via staged publishing.

This updates the prerequisite docs accordingly.

## Changes

- `docs/lib/content/commands/npm-stage.md` — replaced the "Package must
exist" prerequisite with "New or existing packages," clarifying that a
package does not need to pre-exist and that approving a staged brand-new
package creates it.

## Related

Companion docs change in npm/documentation:
https://github.com/npm/documentation/pull/2047 (the generated
`content/cli/*/commands/npm-stage.mdx` pages are synced from this file
via the `update-cli` workflow).

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 docs/lib/content/commands/npm-stage.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/docs/lib/content/commands/npm-stage.md b/docs/lib/content/commands/npm-stage.md
index 563861f92239e..48a2d42e4354b 100644
--- a/docs/lib/content/commands/npm-stage.md
+++ b/docs/lib/content/commands/npm-stage.md
@@ -36,6 +36,7 @@ Key behaviors:
   version for that package.
 * You can still publish packages normally while you have staged packages
   pending.
+* Staged publishing will allow you to create a new package if it does not exist.
 * You can stage multiple versions of the same package.
 * `npm stage publish` has parity with `npm publish` and will respect
   `"private": true` in `package.json`, refusing to stage the package.
@@ -46,8 +47,6 @@ Before using `npm stage` commands, ensure the following requirements are met:
 
 * **Write permissions on the package:** You must have write access to the
   package you're configuring.
-* **Package must exist:** The package you're configuring must already exist
-  on the npm registry.
 * **2FA enabled on your account:** Commands that require 2FA will prompt you
   to authenticate. If you don't already have 2FA enabled on your account,
   you must enable it before using these commands.