Skip to content

[BUG] npm publish results in Cannot find module 'sigstore' #9722

Closed
#9740
Closed
[BUG] npm publish results in Cannot find module 'sigstore'#9722
#9740
Labels
Bugthing that needs fixingNeeds Triageneeds review for next steps

Description

@james-pre
james-pre
opened on Jul 5, 2026

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

This is not just a request to bump a dependency for a CVE

  • This is not solely a request to bump a dependency for a CVE

Current Behavior

This occurred in a CI release workflow run:

Run npm publish --access=public --provenance
npm error code MODULE_NOT_FOUND
npm error Cannot find module 'sigstore'
npm error Require stack:
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/node_modules/libnpmpublish/lib/provenance.js
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/node_modules/libnpmpublish/lib/publish.js
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/node_modules/libnpmpublish/lib/index.js
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/lib/commands/publish.js
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/lib/npm.js
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/lib/cli/entry.js
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/lib/cli.js
npm error - /opt/hostedtoolcache/node/26.4.0/x64/lib/node_modules/npm/bin/npm-cli.js
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-07-05T20_19_26_876Z-debug-0.log

source

Expected Behavior

This should work correctly

Steps To Reproduce

  1. Set up a CI workflow to publish
  2. Run npm publish --access=public --provenance in the workflow
  3. It fails

Environment

  • npm: 12.0.0-pre.2
  • Node.js: 24.6.0
  • OS Name: ubuntu-latest
  • System Model Name: unknown
  • npm config: unavailable (its on a GitHub actions runner), though install-strategy=linked is set in .npmrc

Activity

  1. james-pre
    added
    Bugthing that needs fixing
    Needs Triageneeds review for next steps
    on Jul 5, 2026
  2. Percy2Live
    added a commit that references this issue on Jul 8, 2026

    fix: replace testing-action-deploy with inline OIDC publish steps (#100)

    ced2252
  3. jeremyckahn
    added a commit that references this issue on Jul 8, 2026

    fix: pin release workflow's npm upgrade below v12 (#674)

    599ac68
  4. 0-jake-0
    added a commit that references this issue on Jul 9, 2026

    ci(npm-publish): pin npm to 11.x to avoid sigstore provenance bug (#421)

    4b39190
  5. soddygo
    added a commit that references this issue on Jul 9, 2026

    ci: fix npm publish failing on missing sigstore module

    022ce6b

  6. jleclanche commented on Jul 9, 2026

    @jleclanche
    jleclanche
    on Jul 9, 2026

    We hit the same failure on npm 12.0.0 stable (released 2026-07-08), publishing with OIDC trusted publishing + NPM_CONFIG_PROVENANCE=true on GitHub-hosted runners. Same MODULE_NOT_FOUND for sigstore from libnpmpublish/lib/provenance.js.

    Root cause appears to be a release packaging bug, not an intended change:

    • libnpmpublish@12.0.0 still declares "sigstore": "^5.0.0" in its dependencies, and its lib/provenance.js still requires it.
    • But the published npm-12.0.0.tgz does not contain the module — tar tzf npm-12.0.0.tgz | grep -c '^package/node_modules/sigstore/' returns 0, while npm-11.18.0.tgz bundles it (5 entries). Other sigstore packages (@sigstore/tuf etc.) made it into the 12.0.0 tarball; sigstore itself was dropped somewhere in the bundling step.
    • Neither the npm 12.0.0 nor the libnpmpublish 12.0.0 release notes mention removing provenance support.

    So any npm publish with provenance enabled (explicit --provenance, NPM_CONFIG_PROVENANCE=true, or provenance via trusted publishing) crashes on npm 12.0.0.

    Workaround until a patched 12.x ships: pin the 11.x line in CI — npm install -g npm@11 — which restores a working bundled sigstore.

  7. mauricekleine
    added a commit that references this issue on Jul 9, 2026

    ci(cli-release): pin npm to stable 11.x for the provenance publish

    895cd00
  8. wildwinter
    added a commit that references this issue on Jul 9, 2026

    Release: pin npm to 11.x for publishing (npm 12.0.0 provenance is bro…

    b90255f
  9. SociableSteve
    added a commit that references this issue on Jul 9, 2026

    fix(ci): pin npm to 11.x for release publishing (#429)

    fe1501d

  10. zdm commented on Jul 9, 2026

    @zdm
    zdm
    on Jul 9, 2026

    It also failed when just make simple publish: npm publish.
    sigstore module is missed.

  11. JFLXB
    added a commit that references this issue on Jul 9, 2026

    ci(tagged-release): pin npm to 11.18.0 to fix provenance publish

    75ab1e2
  12. futurepastori
    added a commit that references this issue on Jul 9, 2026

    Pin npm to 11.x for publish (#49)

    c05b004
  13. saba-ch
    added a commit that references this issue on Jul 9, 2026

    ci(release): pin npm to 11.5.1 for provenance publishing

    ba8f0e7
  14. FlorianWendelborn
    added a commit that references this issue on Jul 9, 2026

    versions(schemas@0.1.0): Add Resource Packs, Fix Items

    76fac6c

  15. 71 remaining items

  16. Grinv
    added 2 commits that reference this issue on Jul 29, 2026

    fix: add npm-publish idempotency guard, bump npm pin to 12.0.1

    e850c9e

    feat: harden the release pipeline against every gap found in a cross-…

    a3e19a1
  17. robgilbreath
    added 6 commits that reference this issue on Sep 1, 2026

    ci: pin npm@12.0.2 in publish

    9a36341

    Pin npm@12.0.2 in publish

    c5e4489

    Move validate/publish to ubuntu-latest; release 2.0.53 (#13)

    46342de

    ci: move validate to ubuntu-latest; enforce version bump at publish (#37

    c134f30

    ci: vendor shared-actions v2 composites, pin npm@12.0.2 in publish; r…

    eafd1f0

    ci: pin actions to v7, Dependabot for actions, vendor shared-actions …

    10f2e64
  18. neumark
    added 2 commits that reference this issue on Sep 6, 2026

    R3-527: the release job mirrors prettier-config — approval-gated, npm…

    0f2c0ca

    R3-527: the release job mirrors prettier-config — approval-gated, npm…

    89e9d6f
  19. saithat
    added a commit that references this issue on Sep 24, 2026

    fix(ci): pin npm exactly and drop obsolete npm upgrade steps (medplum…

    44ccb14
  20. inkeep-oss-sync
    added 2 commits that reference this issue on Oct 5, 2026

    Publish OK's npm package from a job that runs no package code (#5571)

    5fcdd2e

    Publish OK's npm package from a job that runs no package code (#5571)

    ab8a96b
  21. wildwinter
    added a commit that references this issue on Oct 5, 2026

    Publish the JavaScript player to npm as @wildwinter/game-subtitles.

    484ba93
  22. msheharyark
    added a commit that references this issue on Oct 8, 2026

    fix(ci): pin npm to 11.x for trusted publishing, avoiding a 12.0.0 pa…

    4e3b119
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Triageneeds review for next steps

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions