chore: keep lockfile registry-agnostic - #7
Merged
Merged
Conversation
Greptile SummaryThis PR makes the npm lockfile registry-agnostic without changing the dependency graph.
Confidence Score: 5/5The PR appears safe to merge because it changes lockfile source metadata without altering dependency resolution or supported installation behavior. No actionable failures remain; supported npm versions honor the new setting, and the lockfile diff is limited to registry URL removal with integrity and dependency data preserved. Important Files Changed
Reviews (1): Last reviewed commit: "chore: keep lockfile registry-agnostic" | Re-trigger Greptile |
lanceblais-wos
approved these changes
Sep 10, 2026
nigel-campbell
approved these changes
Sep 10, 2026
mjdavidson
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Committed public npm lockfiles can expose the Socket Firewall registry URL through generated
resolvedfields, tying public source to an installation route that should remain private.This adds
omit-lockfile-registry-resolved=trueso npm keeps the lockfile registry-agnostic. Regeneration removed 180 registry HTTP(S) resolutions and preserved 180 integrity entries. Dependency versions, package keys, integrity data, dependency relationships, metadata, and legitimate non-registry resolutions are unchanged.Verified with the central HELP-722 migration audit,
git diff --check, a cleannpm cifromhttps://registry.npmjs.org/with a fresh cache,npm run lint,npm run format,npm run format:check, andnpm run typecheck.https://linear.app/workos/issue/HELP-722