diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md
index 05afdfde23f45..12025b3fd07fe 100644
--- a/DEPENDENCIES.md
+++ b/DEPENDENCIES.md
@@ -156,6 +156,7 @@ graph LR;
   npm-registry-fetch-->make-fetch-happen;
   npm-registry-fetch-->minipass-fetch;
   npm-registry-fetch-->npm-package-arg;
+  npm-registry-fetch-->npmcli-redact["@npmcli/redact"];
   npm-registry-fetch-->proc-log;
   npmcli-arborist-->bin-links;
   npmcli-arborist-->cacache;
@@ -590,6 +591,7 @@ graph LR;
   npm-registry-fetch-->minipass;
   npm-registry-fetch-->minizlib;
   npm-registry-fetch-->npm-package-arg;
+  npm-registry-fetch-->npmcli-redact["@npmcli/redact"];
   npm-registry-fetch-->proc-log;
   npmcli-agent-->agent-base;
   npmcli-agent-->http-proxy-agent;
@@ -833,4 +835,4 @@ packages higher up the chain.
  - @npmcli/git, make-fetch-happen, @npmcli/config
  - @npmcli/installed-package-contents, @npmcli/map-workspaces, cacache, npm-pick-manifest, read-package-json, promzard
  - @npmcli/docs, @npmcli/fs, npm-bundled, read-package-json-fast, unique-filename, npm-install-checks, npm-package-arg, normalize-package-data, npm-packlist, bin-links, nopt, npmlog, parse-conflict-json, @npmcli/mock-globals, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, minify-registry-metadata, ini, @npmcli/disparity-colors, mute-stream, @npmcli/redact, npm-audit-report, npm-user-validate
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, minify-registry-metadata, ini, @npmcli/disparity-colors, mute-stream, npm-audit-report, npm-user-validate
diff --git a/node_modules/npm-registry-fetch/lib/check-response.js b/node_modules/npm-registry-fetch/lib/check-response.js
index 066ac3c32420f..183311d840397 100644
--- a/node_modules/npm-registry-fetch/lib/check-response.js
+++ b/node_modules/npm-registry-fetch/lib/check-response.js
@@ -4,7 +4,7 @@ const errors = require('./errors.js')
 const { Response } = require('minipass-fetch')
 const defaultOpts = require('./default-opts.js')
 const log = require('proc-log')
-const cleanUrl = require('./clean-url.js')
+const { redact: cleanUrl } = require('@npmcli/redact')
 
 /* eslint-disable-next-line max-len */
 const moreInfoUrl = 'https://github.com/npm/cli/wiki/No-auth-for-URI,-but-auth-present-for-scoped-registry'
diff --git a/node_modules/npm-registry-fetch/lib/clean-url.js b/node_modules/npm-registry-fetch/lib/clean-url.js
deleted file mode 100644
index 0c2656b5653a0..0000000000000
--- a/node_modules/npm-registry-fetch/lib/clean-url.js
+++ /dev/null
@@ -1,27 +0,0 @@
-const { URL } = require('url')
-
-const replace = '***'
-const tokenRegex = /\bnpm_[a-zA-Z0-9]{36}\b/g
-const guidRegex = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g
-
-const cleanUrl = (str) => {
-  if (typeof str !== 'string' || !str) {
-    return str
-  }
-
-  try {
-    const url = new URL(str)
-    if (url.password) {
-      url.password = replace
-      str = url.toString()
-    }
-  } catch {
-    // ignore errors
-  }
-
-  return str
-    .replace(tokenRegex, `npm_${replace}`)
-    .replace(guidRegex, `npm_${replace}`)
-}
-
-module.exports = cleanUrl
diff --git a/node_modules/npm-registry-fetch/lib/index.js b/node_modules/npm-registry-fetch/lib/index.js
index bb413f862d92d..1d77a77024bf5 100644
--- a/node_modules/npm-registry-fetch/lib/index.js
+++ b/node_modules/npm-registry-fetch/lib/index.js
@@ -10,6 +10,7 @@ const qs = require('querystring')
 const url = require('url')
 const zlib = require('minizlib')
 const { Minipass } = require('minipass')
+const { redact: cleanUrl } = require('@npmcli/redact')
 
 const defaultOpts = require('./default-opts.js')
 
@@ -246,4 +247,6 @@ function getHeaders (uri, auth, opts) {
   return headers
 }
 
-module.exports.cleanUrl = require('./clean-url.js')
+// export cleanUrl to avoid a breaking change
+// TODO: next semver major remove this. Consumers should use @npmcli/redact instead
+module.exports.cleanUrl = cleanUrl
diff --git a/node_modules/npm-registry-fetch/package.json b/node_modules/npm-registry-fetch/package.json
index b715d52391a93..88455a4971af0 100644
--- a/node_modules/npm-registry-fetch/package.json
+++ b/node_modules/npm-registry-fetch/package.json
@@ -1,6 +1,6 @@
 {
   "name": "npm-registry-fetch",
-  "version": "16.1.0",
+  "version": "16.2.0",
   "description": "Fetch-based http client for use with npm registry APIs",
   "main": "lib",
   "files": [
@@ -9,7 +9,7 @@
   ],
   "scripts": {
     "eslint": "eslint",
-    "lint": "eslint \"**/*.js\"",
+    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
     "lintfix": "npm run lint -- --fix",
     "test": "tap",
     "posttest": "npm run lint",
@@ -31,6 +31,7 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "dependencies": {
+    "@npmcli/redact": "^1.1.0",
     "make-fetch-happen": "^13.0.0",
     "minipass": "^7.0.2",
     "minipass-fetch": "^3.0.0",
@@ -41,7 +42,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.19.0",
+    "@npmcli/template-oss": "4.21.3",
     "cacache": "^18.0.0",
     "nock": "^13.2.4",
     "require-inject": "^1.4.4",
@@ -61,7 +62,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.19.0",
+    "version": "4.21.3",
     "publish": "true"
   }
 }
diff --git a/package-lock.json b/package-lock.json
index 324c60c2a27e8..d4afc5ee58873 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -140,7 +140,7 @@
         "npm-package-arg": "^11.0.1",
         "npm-pick-manifest": "^9.0.0",
         "npm-profile": "^9.0.0",
-        "npm-registry-fetch": "^16.1.0",
+        "npm-registry-fetch": "^16.2.0",
         "npm-user-validate": "^2.0.0",
         "npmlog": "^7.0.1",
         "p-map": "^4.0.0",
@@ -10103,11 +10103,12 @@
       }
     },
     "node_modules/npm-registry-fetch": {
-      "version": "16.1.0",
-      "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-16.1.0.tgz",
-      "integrity": "sha512-PQCELXKt8Azvxnt5Y85GseQDJJlglTFM9L9U9gkv2y4e9s0k3GVDdOx3YoB6gm2Do0hlkzC39iCGXby+Wve1Bw==",
+      "version": "16.2.0",
+      "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-16.2.0.tgz",
+      "integrity": "sha512-zVH+G0q1O2hqgQBUvQ2LWp6ujr6VJAeDnmWxqiMlCguvLexEzBnuQIwC70r04vcvCMAcYEIpA/rO9YyVi+fmJQ==",
       "inBundle": true,
       "dependencies": {
+        "@npmcli/redact": "^1.1.0",
         "make-fetch-happen": "^13.0.0",
         "minipass": "^7.0.2",
         "minipass-fetch": "^3.0.0",
@@ -16080,7 +16081,7 @@
         "npm-install-checks": "^6.2.0",
         "npm-package-arg": "^11.0.1",
         "npm-pick-manifest": "^9.0.0",
-        "npm-registry-fetch": "^16.0.0",
+        "npm-registry-fetch": "^16.2.0",
         "npmlog": "^7.0.1",
         "pacote": "^17.0.4",
         "parse-conflict-json": "^3.0.0",
@@ -16139,7 +16140,7 @@
       "license": "ISC",
       "dependencies": {
         "npm-package-arg": "^11.0.1",
-        "npm-registry-fetch": "^16.0.0"
+        "npm-registry-fetch": "^16.2.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
@@ -16225,7 +16226,7 @@
       "license": "ISC",
       "dependencies": {
         "aproba": "^2.0.0",
-        "npm-registry-fetch": "^16.0.0"
+        "npm-registry-fetch": "^16.2.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
@@ -16242,7 +16243,7 @@
       "license": "ISC",
       "dependencies": {
         "aproba": "^2.0.0",
-        "npm-registry-fetch": "^16.0.0"
+        "npm-registry-fetch": "^16.2.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
@@ -16282,7 +16283,7 @@
         "ci-info": "^4.0.0",
         "normalize-package-data": "^6.0.0",
         "npm-package-arg": "^11.0.1",
-        "npm-registry-fetch": "^16.0.0",
+        "npm-registry-fetch": "^16.2.0",
         "proc-log": "^3.0.0",
         "semver": "^7.3.7",
         "sigstore": "^2.2.0",
@@ -16304,7 +16305,7 @@
       "version": "7.0.1",
       "license": "ISC",
       "dependencies": {
-        "npm-registry-fetch": "^16.0.0"
+        "npm-registry-fetch": "^16.2.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
@@ -16321,7 +16322,7 @@
       "license": "ISC",
       "dependencies": {
         "aproba": "^2.0.0",
-        "npm-registry-fetch": "^16.0.0"
+        "npm-registry-fetch": "^16.2.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
diff --git a/package.json b/package.json
index 247df83d014d0..a3b3c721b666a 100644
--- a/package.json
+++ b/package.json
@@ -102,7 +102,7 @@
     "npm-package-arg": "^11.0.1",
     "npm-pick-manifest": "^9.0.0",
     "npm-profile": "^9.0.0",
-    "npm-registry-fetch": "^16.1.0",
+    "npm-registry-fetch": "^16.2.0",
     "npm-user-validate": "^2.0.0",
     "npmlog": "^7.0.1",
     "p-map": "^4.0.0",
diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index 5ecb25e1528c9..707e1ad5c06a6 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -24,7 +24,7 @@
     "npm-install-checks": "^6.2.0",
     "npm-package-arg": "^11.0.1",
     "npm-pick-manifest": "^9.0.0",
-    "npm-registry-fetch": "^16.0.0",
+    "npm-registry-fetch": "^16.2.0",
     "npmlog": "^7.0.1",
     "pacote": "^17.0.4",
     "parse-conflict-json": "^3.0.0",
diff --git a/workspaces/libnpmaccess/package.json b/workspaces/libnpmaccess/package.json
index 8b8459dcec251..6a287f78ce34f 100644
--- a/workspaces/libnpmaccess/package.json
+++ b/workspaces/libnpmaccess/package.json
@@ -30,7 +30,7 @@
   "homepage": "https://npmjs.com/package/libnpmaccess",
   "dependencies": {
     "npm-package-arg": "^11.0.1",
-    "npm-registry-fetch": "^16.0.0"
+    "npm-registry-fetch": "^16.2.0"
   },
   "engines": {
     "node": "^16.14.0 || >=18.0.0"
diff --git a/workspaces/libnpmhook/package.json b/workspaces/libnpmhook/package.json
index 0bd822abba2c3..f881d78f7fc0f 100644
--- a/workspaces/libnpmhook/package.json
+++ b/workspaces/libnpmhook/package.json
@@ -31,7 +31,7 @@
   "license": "ISC",
   "dependencies": {
     "aproba": "^2.0.0",
-    "npm-registry-fetch": "^16.0.0"
+    "npm-registry-fetch": "^16.2.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
diff --git a/workspaces/libnpmorg/package.json b/workspaces/libnpmorg/package.json
index a0aedb79b6084..f7706247dc8dd 100644
--- a/workspaces/libnpmorg/package.json
+++ b/workspaces/libnpmorg/package.json
@@ -42,7 +42,7 @@
   "homepage": "https://npmjs.com/package/libnpmorg",
   "dependencies": {
     "aproba": "^2.0.0",
-    "npm-registry-fetch": "^16.0.0"
+    "npm-registry-fetch": "^16.2.0"
   },
   "engines": {
     "node": "^16.14.0 || >=18.0.0"
diff --git a/workspaces/libnpmpublish/package.json b/workspaces/libnpmpublish/package.json
index 67f63816d90d5..77500f573184c 100644
--- a/workspaces/libnpmpublish/package.json
+++ b/workspaces/libnpmpublish/package.json
@@ -41,7 +41,7 @@
     "ci-info": "^4.0.0",
     "normalize-package-data": "^6.0.0",
     "npm-package-arg": "^11.0.1",
-    "npm-registry-fetch": "^16.0.0",
+    "npm-registry-fetch": "^16.2.0",
     "proc-log": "^3.0.0",
     "semver": "^7.3.7",
     "sigstore": "^2.2.0",
diff --git a/workspaces/libnpmsearch/package.json b/workspaces/libnpmsearch/package.json
index 42cb78839081c..70001f1349d07 100644
--- a/workspaces/libnpmsearch/package.json
+++ b/workspaces/libnpmsearch/package.json
@@ -38,7 +38,7 @@
   "bugs": "https://github.com/npm/libnpmsearch/issues",
   "homepage": "https://npmjs.com/package/libnpmsearch",
   "dependencies": {
-    "npm-registry-fetch": "^16.0.0"
+    "npm-registry-fetch": "^16.2.0"
   },
   "engines": {
     "node": "^16.14.0 || >=18.0.0"
diff --git a/workspaces/libnpmteam/package.json b/workspaces/libnpmteam/package.json
index bafeeb3fcdc4c..117d0b0633458 100644
--- a/workspaces/libnpmteam/package.json
+++ b/workspaces/libnpmteam/package.json
@@ -32,7 +32,7 @@
   "homepage": "https://npmjs.com/package/libnpmteam",
   "dependencies": {
     "aproba": "^2.0.0",
-    "npm-registry-fetch": "^16.0.0"
+    "npm-registry-fetch": "^16.2.0"
   },
   "engines": {
     "node": "^16.14.0 || >=18.0.0"