Repository navigation
Keep registry URLs out of the docs npm lockfile - #2068
Merged
DariuszPorowski merged 1 commit intoOct 28, 2026
Merged
Conversation
Add docs/.npmrc with omit-lockfile-registry-resolved=true so npm writes package-lock.json without registry download URLs. Regenerate the lockfile once, which removes the 59 resolved entries. Versions and integrity hashes are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Karishma Chawla <kachawla@microsoft.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
DariuszPorowski
approved these changes
Oct 28, 2026
DariuszPorowski
deleted the
kachawla-npm-lockfile-omit-registry-resolved
branch
October 28, 2026 23:51
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
docs/.npmrcwithomit-lockfile-registry-resolved=trueand regeneratedocs/package-lock.jsononce so it no longer stores registry download URLs.Reason for change
npm writes each package's full download URL into the lockfile's
resolvedfields, using whatever registry the author installed from. If that is a private mirror, those URLs get committed. In radius-project/samples#2698 this put 214 private registry URLs into a lockfile, which broke Dependabot and the upmerge to edge, and took radius-project/samples#2709, radius-project/samples#2710, and radius-project/samples#2713 to clean up.The docs lockfile only has
registry.npmjs.orgURLs today, so this is preventive. Withomit-lockfile-registry-resolvedset, npm writes lockfiles without aresolvedkey for registry dependencies. Package versions andintegrityhashes stay, so installs remain pinned and verified, and each install uses the registry configured on that machine.The
.npmrcsits next topackage.jsonbecause npm reads project config from there. It does not setregistry, so local registry settings keep working.The one-time lockfile diff removes the 59
resolvedlines and nothing else. No versions orintegrityhashes changed.This mirrors radius-project/samples#2719.
How to test
docs/, runnpm install --package-lock-onlyand confirmgit diffshows no changes andgrep -c '"resolved"' package-lock.jsonprints0.resolvedfields. This should print nothing:docs/, runnpm ciandnpm run build. Both should succeed, as in the Radius Website workflow on this PR.File change summary
docs/.npmrcomit-lockfile-registry-resolved=true.docs/package-lock.jsonresolvedURLs. No other changes.