Environment variables
This reference uses jup's JUP_* names. Every JUP_* variable also accepts the equivalent COREPACK_* name for Corepack compatibility. If both are present, JUP_* takes priority.
#Project behavior
| Variable | Purpose |
|---|---|
JUP_ENABLE_PROJECT_SPEC=0 | Ignore package manager declarations in the project. |
JUP_ENABLE_STRICT=0 | Allow a command for a different manager than the project declares. |
JUP_ENABLE_AUTO_PIN=1 | Add a pin when a project has no package manager declaration. |
JUP_ENABLE_PRERELEASES=1 | Include prereleases during automatic version selection. |
JUP_FROZEN_LOCKFILE=1 | Refuse to create or update range resolutions in .corepack.lock. When unset, jup enables this behavior whenever CI is set. |
JUP_MINIMUM_RELEASE_AGE=<hours> | Exclude newer releases from automatic selection. Exact pins and cached releases are unaffected. |
JUP_SPEC_FILE=<path> | Read the project declaration from a specific file instead of discovering package.json. |
#Cache and resolution
| Variable | Purpose |
|---|---|
JUP_HOME=<path> | Change the cache, signing-key, and global-fallback directory. |
JUP_ENABLE_NETWORK=0 | Block every network request. Required releases must already be cached. |
JUP_DEFAULT_TO_LATEST=0 | Use jup's built-in fallback rather than looking up the latest stable release. |
JUP_SHIM_DIRECTORY=<path> | Set the default directory used by jup enable and jup disable. |
#Registry and authentication
| Variable | Purpose |
|---|---|
JUP_NPM_REGISTRY=<url> | Set the npm-compatible registry used for package manager metadata. |
JUP_REGISTRY_NPM=<url> | Override the download base for npm only. |
JUP_REGISTRY_PNPM=<url> | Override the download base for pnpm only. |
JUP_REGISTRY_YARN=<url> | Override the download base for Yarn only. |
JUP_NPM_TOKEN=<token> | Send bearer authentication to the configured registry origin. |
JUP_NPM_USERNAME=<name> | Set the basic-auth username. Requires JUP_NPM_PASSWORD. |
JUP_NPM_PASSWORD=<password> | Set the basic-auth password. Requires JUP_NPM_USERNAME. |
#Network and TLS
| Variable | Purpose |
|---|---|
JUP_CAFILE=<path> | Use a PEM certificate bundle instead of the platform trust store. |
JUP_STRICT_SSL=0 | Disable TLS certificate verification and print a warning. |
JUP_NETWORK_TIMEOUT=<ms> | Set connection and idle timeouts. The default is 30000. |
JUP_NETWORK_RETRIES=<count> | Set total request attempts. The default is 3; 0 disables retries. |
jup also supports uppercase and lowercase HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY.
#Verification and downloads
| Variable | Purpose |
|---|---|
JUP_ENABLE_DOWNLOAD_PROMPT=1 | Announce downloads and request confirmation on an interactive terminal. |
JUP_REQUIRE_SIGNATURES=1 | Reject registry metadata without a valid signature. |
JUP_ALLOW_UNVERIFIED=1 | Allow an artifact with no usable signature or digest and print a warning. |
JUP_INTEGRITY_KEYS=<json> | Replace the trusted registry signing keys. 0 disables signature verification. |
JUP_ENABLE_UNSAFE_CUSTOM_URLS=1 | Allow known package managers to use custom URLs. |
The variables in this section change what jup trusts. Set them only in the process environment. jup ignores them when they come from a project's .corepack.env.
#Env files
A repository may place non-sensitive behavior settings in .corepack.env:
JUP_ENABLE_STRICT=0
JUP_NETWORK_TIMEOUT=60000jup uses the closest matching file between the current directory and project root. Set JUP_ENV_FILE to another filename or path, or set it to 0 to disable env files.
Process environment values take priority over env-file values. jup ignores credentials, trust configuration, certificate settings, unverified-download flags, and unsafe URL controls from a repository env file.
#Variables set by jup
These variables are primarily for package managers and shims rather than manual configuration:
| Variable | Purpose |
|---|---|
JUP_ROOT | Identifies the jup installation used by a shim. The compatible COREPACK_ROOT form is also passed to child processes. |
JUP_MIGRATE_FROM | Carries migration context into a package manager setup command. |
JUP_NODE_EXECPATH | Selects the Node.js executable used for a JavaScript package manager. |
Use jup info or jup info --json to inspect the effective configuration. Credentials are reported only as present or absent.