npm "warn config … deprecated" - Fix Deprecated .npmrc Settings in CI

By Daniel Zoghalchali·Latchkey

These warnings mean your .npmrc (or install flags) still use settings newer npm has deprecated. They do not fail the build by themselves, but they signal config that may stop working, and they clutter logs.

What this error means

Every npm command prints npm warn config <key> ... deprecated, naming an old setting and its replacement. The install still runs, but the deprecated key may be silently ignored or behave differently than intended.

npm warn config production Use `--omit=dev` instead.
npm warn config cache-min This option is deprecated and will be removed.
npm warn config optional Use `--omit=optional` to exclude optional dependencies.

Diagnose it: which registry, and with what credentials?

Registry errors are resolved in a precedence chain, and the effective value is rarely the one in the file you are looking at. Scoped registries, .npmrc files at several levels, and environment variables all combine before a request is made.

# the effective, fully merged configuration
npm config list -l | grep -E "registry|_auth|always-auth"

# where each value came from
npm config get registry
npm config get @yourscope:registry

# prove the token works, independently of the install
curl -sI -H "Authorization: Bearer $NPM_TOKEN" \
  "$(npm config get registry)@yourscope%2fpackage" | head -1

Common causes

Legacy .npmrc keys

Settings like production=true, cache-min, or optional were valid in older npm and are now deprecated in favor of omit/include and other current keys.

Old install flags in CI scripts

CI scripts still passing --production or other deprecated flags trigger the warning on every run.

How to fix it

Migrate to current config keys

Replace deprecated keys with their modern equivalents.

# old
production=true
# new
omit=dev

# old flag
npm ci --production
# new flag
npm ci --omit=dev

Audit .npmrc against the installed npm

1. List effective config with npm config ls -l and look for deprecated keys.
2. Update both committed .npmrc and CI flags together.
3. Re-run to confirm the warnings are gone and behavior is unchanged.

How to prevent it

• Keep .npmrc aligned with the npm version in CI.
• Replace --production with --omit=dev in scripts.
• Review config warnings when bumping npm.

Frequently asked questions

Related guides

References

• Node.js documentation
• npm CLI documentation
• GitHub Actions documentation