eslint suggestions
credentials: less magical, more dynamical
email is now always scoped to a registry
actually include update changes