{
  "id": "P007",
  "slug": "npm-upgrade-https-tarball-dependency-policy-error-package-json-remote-tarball-rejected",
  "status": "search-observed",
  "product": "npm",
  "family": "Security default flip",
  "canonical_url": "https://gitdocs.org/fix/npm-upgrade-https-tarball-dependency-policy-error-package-json-remote-tarball-rejected",
  "query_alias_url": "https://gitdocs.org/q/npm-upgrade-https-tarball-dependency-policy-error-package-json-remote-tarball-rejected",
  "markdown_url": "https://gitdocs.org/fix/npm-upgrade-https-tarball-dependency-policy-error-package-json-remote-tarball-rejected.md",
  "json_url": "https://gitdocs.org/api/fixes/npm-upgrade-https-tarball-dependency-policy-error-package-json-remote-tarball-rejected.json",
  "canonical_query": "npm upgrade HTTPS tarball dependency policy error package.json remote tarball rejected",
  "observed_codex_queries": [
    "npm upgrade HTTPS tarball dependency policy error package.json remote tarball rejected",
    "\"policy error\" \"npm\" \"tarball\"",
    "\"ERR!\" \"policy\" \"npm\" \"https://\" \"tar.gz\"",
    "site:docs.npmjs.com package.json tarball dependencies URLs npm",
    "npm package.json URLs as dependencies tarball git docs",
    "\"remote tarball dependency\" \"npm\"",
    "\"npm\" \"policy error\" \"install\"",
    "https://docs.npmjs.com/cli/v11/configuring-npm/package-json",
    "'URLs as Dependencies' in https://docs.npmjs.com/cli/v11/configuring-npm/package-json",
    "https://docs.npmjs.com/cli/v11/commands/npm-trust",
    "https://docs.npmjs.com/cli/v11/commands/npm-approve-scripts",
    "https://docs.npmjs.com/cli/v11/commands/npm-deny-scripts",
    "https://docs.npmjs.com/cli/v11/using-npm/config",
    "'allow-remote' in https://docs.npmjs.com/cli/v11/using-npm/config"
  ],
  "organic_dependency_search_count": 14,
  "affected_versions": "",
  "exact_errors": [],
  "diagnosis": "The repository can show the old configuration and a generic denial, but only the current external policy identifies the newly required allow-list or opt-out.",
  "before": "",
  "after": "",
  "verification": "Hidden verifier checks the least-permissive current configuration and confirms the blocked capability is restored without globally disabling the protection. Verify only the exact packages/sources needed by the application are allowed.",
  "unsafe_fixes": [
    "Changing local code without checking the current external contract.",
    "Retrying the same install, build, or API call with no version/source change.",
    "Applying a broad unsafe bypass when a narrow compatibility fix is available."
  ],
  "last_verified_at": "2026-06-25",
  "neutral_validation": {
    "organic_search_observed": true,
    "organic_strict_pass": true,
    "no_web_counterfactual_run": false,
    "no_web_strict_pass": null,
    "search_necessity_under_fixture": null,
    "no_web_oracle_note": "Observed query evidence is separated from necessity proof; no-web and stale-contract counterfactuals should be tracked separately."
  },
  "source_trail": [
    {
      "url": "https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/",
      "label": "Upcoming breaking changes for npm v12"
    },
    {
      "url": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json",
      "label": "Official reference opened by Codex"
    },
    {
      "url": "https://docs.npmjs.com/cli/v11/commands/npm-trust",
      "label": "Official reference opened by Codex"
    },
    {
      "url": "https://docs.npmjs.com/cli/v11/commands/npm-approve-scripts",
      "label": "Official reference opened by Codex"
    },
    {
      "url": "https://docs.npmjs.com/cli/v11/commands/npm-deny-scripts",
      "label": "Official reference opened by Codex"
    },
    {
      "url": "https://docs.npmjs.com/cli/v11/using-npm/config",
      "label": "Official reference opened by Codex"
    }
  ],
  "source_github_links": []
}