TLS 1.2 becomes the minimum for npm

Starting October 4, 2021, every connection to npm websites and the public npm registry—including package installs—will require TLS 1.2 or newer. The change follows GitHub's earlier removal of TLS 1.0 and TLS 1.1 support across its services and extends that same security baseline to npmjs.com and the registry.

The impact should be minimal: approximately 99% of registry traffic already uses TLS 1.2. Every official Node.js binary release since v0.10.0 ships with TLS 1.2 support, so users on standard, recent Node.js and npm builds typically need to do nothing. The exception is anyone running an unsupported version or a custom-compiled Node.js binary that lacks TLS 1.2.

Deprecation schedule

Rather than flipping the switch all at once, GitHub will give affected users a series of advance warnings and short enforcement windows.

  • August 24: npm commands that use TLS 1.0 or TLS 1.1 will display a notification linking to this blog post.
  • September 22, 05:00 UTC: TLS 1.2 enforcement for one hour.
  • September 27, 10:00 UTC and 18:00 UTC: TLS 1.2 enforcement for one hour each.
  • September 29, 13:00 UTC: TLS 1.2 enforcement for six hours.

These windows give users on older setups a concrete way to test compatibility before the permanent cutoff in October.

Checking your setup

You can verify that your npm client supports TLS 1.2 by installing a test package from an HTTPS endpoint that already rejects TLS 1.0 and TLS 1.1:

npm install -g https://tls-test.npmjs.com/tls-test-1.0.0.tgz

A successful install shows this confirmation:

Hello! The tls-test package was successfully downloaded and installed.

Congratulations! Your package manager appears to support TLS 1.2.

If instead you see a TLS error, upgrade to a currently supported version of Node.js and the latest npm v7 release before the October 4 deadline.