From 0b4e9b3e44536a96a907af7882288c674aad8723 Mon Sep 17 00:00:00 2001
From: Charles Lyding <19598772+clydin@users.noreply.github.com>
Date: Tue, 9 Jun 2026 15:13:56 -0400
Subject: [PATCH] fix(@angular/cli): remove forceAuth and unscoped credential
 parsing

Remove the non-standard forceAuth option and custom parsing for unscoped registry
credentials (token, username, password, auth) in package-metadata.ts.

Since the npm CLI does not support unscoped credentials and ignores them by
default, this aligning removes the unnecessary parsing complexity. Unscoped
credentials will now behave identically to any other standard configuration
property, falling through to default configuration parsing.
---
 .../cli/src/utilities/package-metadata.ts       | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/packages/angular/cli/src/utilities/package-metadata.ts b/packages/angular/cli/src/utilities/package-metadata.ts
index fd31000f989a..05a739e898ae 100644
--- a/packages/angular/cli/src/utilities/package-metadata.ts
+++ b/packages/angular/cli/src/utilities/package-metadata.ts
@@ -52,9 +52,7 @@ export interface PackageManifest extends Manifest, NgPackageManifestProperties {
   peerDependenciesMeta?: Record<string, { optional?: boolean }>;
 }
 
-interface PackageManagerOptions extends Record<string, unknown> {
-  forceAuth?: Record<string, unknown>;
-}
+type PackageManagerOptions = Record<string, unknown>;
 
 let npmrc: PackageManagerOptions;
 const npmPackageJsonCache = new Map<string, Promise<Partial<NpmRepositoryPackageJson>>>();
@@ -175,19 +173,6 @@ function normalizeOptions(
     }
 
     switch (key) {
-      // Unless auth options are scope with the registry url it appears that npm-registry-fetch ignores them,
-      // even though they are documented.
-      // https://github.com/npm/npm-registry-fetch/blob/8954f61d8d703e5eb7f3d93c9b40488f8b1b62ac/README.md
-      // https://github.com/npm/npm-registry-fetch/blob/8954f61d8d703e5eb7f3d93c9b40488f8b1b62ac/auth.js#L45-L91
-      case '_authToken':
-      case 'token':
-      case 'username':
-      case 'password':
-      case '_auth':
-      case 'auth':
-        options['forceAuth'] ??= {};
-        options['forceAuth'][key] = substitutedValue;
-        break;
       case 'noproxy':
       case 'no-proxy':
         options['noProxy'] = substitutedValue;