.npmrc auth lines with spaces around "=" bypass env-var stripping, silently breaking authentication

[RahulGautamSingh]

Discussed in #44362

^{Originally posted by akumria July 4, 2026}

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.249.7-full

Please tell us more about your question or problem

We have customers who utilise .npmrc with authentication values in them.

Within the .npmrc if the line is:

//artifactory.internal.XXX/artifactory/api/npm/:_auth=${ARTIFACTORY_ENTERPRISE_NPM_AUTH}

However if the lnie is:

//artifactory.internal.XXX/artifactory/api/npm/:_auth = ${ARTIFACTORY_ENTERPRISE_NPM_AUTH}

(notice the spaces)

Then authentication, even if specified within renovate host rules, with different credentials, breaks.

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks