[reggi]

Summary

Allow the JSONStream fixture to fetch its transitive Git dependency when CITGM runs its tests with npm 12.

Why this is needed

npm 12 changed allow-git to default to none. JSONStream itself does not use a Git dependency at runtime, but CITGM installs its development dependencies to execute the package test suite. The selected dependency tree contains:

[email protected]
└── [email protected]
    └── [email protected]
        └── fomatto@git://github.com/BonsaiDen/Fomatto.git#468666f600b46f9067e3da7200fd9df428923ea6

[email protected] references fomatto directly by Git commit. npm 12 therefore stops installation with EALLOWGIT before the JSONStream tests execute.

The Git dependency is transitive, so allow-git=root would not permit it. This change sets npm_config_allow_git=all only in JSONStream's CITGM environment. npm's default policy remains unchanged for every other fixture.

JSONStream remains useful in CITGM because it exercises an existing package name containing uppercase characters, as discussed in #1113.

Addresses npm/cli#10026. This replaces the unmerged approach from #1127 without changing JSONStream's unrelated platform skips.

Validation

• ./node_modules/.bin/eslint --cache
• ./node_modules/.bin/prettier --check lib/lookup.json
• ./node_modules/.bin/tap run test/test-lookup.js test/test-create-options.js
• jq empty lib/lookup.json
• git diff --check

The full test suite was also attempted locally. Tests that spawn npm could not run because the machine's npm executable is linked to an npm/cli checkout with missing workspace links. The targeted lookup and environment tests pass.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.20%. Comparing base (37e1545) to head (cf055cb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1158   +/-   ##
=======================================
  Coverage   96.20%   96.20%           
=======================================
  Files          29       29           
  Lines        2213     2213           
=======================================
  Hits         2129     2129           
  Misses         84       84           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[MikeMcC399]

I originally submitted the same change as you've suggested here in #1127 which I then abandoned since nobody was available to merge it.

In the meantime the repo has become active again.

Hopefully this time it will be actioned!

[reggi]

Hey, @BethGriggs can you merge this one? If not i'd be down fo make changes!

[MikeMcC399]

@nodejs/citgm

Please merge this PR!

JSONStream has a hard failure with citgm JSONStream testing against Node.js nightly, and can be expected to fail against Node.js 27.x-staging / 27.x-proposal when these branches are created.

From v27.0.0-nightly202610259b5d938fad without this PR:

$ citgm JSONStream
info: starting            | JSONStream          
info: lookup              | JSONStream          
info: lookup-found        | JSONStream          
info: JSONStream lookup-replace| https://github.com/dominictarr/JSONStream/archive/0593d4b4e6c63c6c0e2e68463538fd83bd1eb964.tar.gz
info: JSONStream npm:     | Downloading project: https://github.com/dominictarr/JSONStream/archive/0593d4b4e6c63c6c0e2e68463538fd83bd1eb964.tar.gz
info: JSONStream npm:     | Project downloaded 0593d4b4e6c63c6c0e2e68463538fd83bd1eb964.tar.gz
info: JSONStream npm:     | npm install started 
warn: JSONStream npm-install:| npm error code EALLOWGIT
warn: JSONStream npm-install:| npm error Fetching packages of type "git" have been disabled                                                         
warn:                        | npm error Refusing to fetch "fomatto@git://github.com/BonsaiDen/Fomatto.git#468666f600b46f9067e3da7200fd9df428923ea6"
warn: JSONStream npm-install:| npm error A complete log of this run can be found in: /tmp/2724f7c6/home/.npm/_logs/2026-10-26T07_34_16_887Z-debug-0.log
error: failure             | Install Failed      
error: failing module(s)   |                     
error: module name:        | JSONStream          
error: version:            | 1.3.5               
error: error:              | Install Failed      
error: error:              | undefined                                                                                                               
error:                     | npm error code EALLOWGIT                                                                                                
error:                     | npm error Fetching packages of type "git" have been disabled                                                            
error:                     | npm error Refusing to fetch "fomatto@git://github.com/BonsaiDen/Fomatto.git#468666f600b46f9067e3da7200fd9df428923ea6"   
error:                     | npm error A complete log of this run can be found in: /tmp/2724f7c6/home/.npm/_logs/2026-10-26T07_34_16_887Z-debug-0.log
error: done                | The smoke test has failed.
info: duration            | test duration: 4809ms

[BethGriggs]

We had security releases last week, and historically we’ve tried to avoid making changes to CITGM during release periods to reduce the risk of introducing instability. While release-please and queued releases make this less of a concern, that’s still no reason to rush changes through.

I also personally curious to see the initial impact of npm12/Node.js 27 before patching the lookup to accommodate it.

CITGM is primarily a tool for releasers, and keeping the dashboard green for its own sake isn’t always the highest priority. We prioritise communicating with maintainers and keeping the ecosystem healthy over simply making the dashboard green.

[MikeMcC399]

My request was possibly a little mixed up. I wasn't actually requesting a release right now, I just wanted to ensure that this change, requested by @reggi from the npm release team, finally gets merged. They use citgm in https://github.com/npm/cli/blob/latest/.github/workflows/node-integration.yml as part of the npm release process into Node.js. JSONStream has already been failing in that workflow since [email protected] at the beginning of August 2026.

This goes back to a general issue #1113 I raised also in August, so I was hoping that we could finally put this one to bed without further delays.

If all goes well, Node.js 26 will transition to LTS today and Node.js 27 Alpha will release. It should not be a worry to cut new citgm releases once that has quietened down.