404 for `@wordpress/vips` when installing dependencies

[Hug0-Drelon]

Description

What?

In some projects we have dependencies to several Gutenberg packages.
We experience some issues while installing them (both locally and in CI).
See the following error:

npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/@wordpress%2fvips - Not found
npm error 404
npm error 404  The requested resource '@wordpress/vips@^1.0.0-prerelease' could not be found or you do not have permission to access it.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.
npm error A complete log of this run can be found in: /Users/myname/.npm/_logs/2026-02-19T09_19_41_019Z-debug-0.log

Why?

It seems that @wordpress/vips is not published to NPM but required in other packages.
We were able to trace it down to @wordpress/upload-media which is used in @wordpress/block-editor (which we depends on)
It is problematic because our CI can't run (no e2e tests, nor ESLint).

Is there anything we can do on our side to prevent such errors? Or is it entirely in your hand?

Thanks for looking into it!

Step-by-step reproduction instructions

• Require @wordpress/block-editor as peerDependency
• Run npm install
• See the errors

Screenshots, screen recording, code snippet

No response

Environment info

No response

Please confirm that you have searched existing issues in the repo.

• Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

• Yes

Please confirm which theme type you used for testing.

• Block
• Classic
• Hybrid (e.g. classic with theme.json)
• Not sure

[talldan]

Sharing a link to the discussion in the Making WordPress slack about this - https://wordpress.slack.com/archives/C02QB2JS7/p1771490304009319

[ockham]

Also reported here.

[Hug0-Drelon]

Thank you guys for the feedback!
I guess will wait and see.

[ockham]

Pinging @adamsilverstein who's probably best suited to fix this 👋

[justlevine]

Not sure if you need more test reports, but we (cc @up1512001 ) ran into this when bumping @wordpress/block-editor from 15.11.0-> 15.13.0.

[jakebailey]

This also has broken all of DefinitelyTyped: https://github.com/DefinitelyTyped/DefinitelyTyped/actions/runs/22181381840/job/64143404617

(I don't know how this is physically possible; the registry is supposed to reject this kind of thing.)

[up1512001]

Same is happening for @wordpress/upload-media when trying to update it from 0.18.5 => 0.25.0

[joshualip-plaudit]

Assuming that you are using pnpm, adding the following to your package.json file will bypass the issue provided that you are using @wordpress/scripts in your build process:

	"pnpm": {
		"overrides": {
			"@wordpress/vips": "-"
		}
	}

For clarity: this only works for people using @wordpress/scripts because all that this does is stop PNPM from trying to resolve the package. If you are working on something that requires WordPress's code to be buildable, this won't help.