Skip to content

chore: keep lockfile registry-agnostic - #7

Merged
peakematt merged 1 commit into
mainfrom
chore/help-722-omit-lockfile-registry-resolved
Sep 11, 2026
Merged

peakematt merged 1 commit into
mainfrom
chore/help-722-omit-lockfile-registry-resolved

Conversation

@peakematt

Copy link
Copy Markdown
Contributor

Committed public npm lockfiles can expose the Socket Firewall registry URL through generated resolved fields, tying public source to an installation route that should remain private.

This adds omit-lockfile-registry-resolved=true so npm keeps the lockfile registry-agnostic. Regeneration removed 180 registry HTTP(S) resolutions and preserved 180 integrity entries. Dependency versions, package keys, integrity data, dependency relationships, metadata, and legitimate non-registry resolutions are unchanged.

Verified with the central HELP-722 migration audit, git diff --check, a clean npm ci from https://registry.npmjs.org/ with a fresh cache, npm run lint, npm run format, npm run format:check, and npm run typecheck.

https://linear.app/workos/issue/HELP-722

@linear-code

linear-code Bot commented Sep 9, 2026

Copy link
Copy Markdown

HELP-722

@peakematt
peakematt marked this pull request as ready for review September 9, 2026 22:03
@peakematt
peakematt requested review from a team as code owners September 9, 2026 22:03

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Devin Review

@greptile-apps

greptile-apps Bot commented Sep 9, 2026

Copy link
Copy Markdown

Greptile Summary

This PR makes the npm lockfile registry-agnostic without changing the dependency graph.

  • Adds omit-lockfile-registry-resolved=true to the project npm configuration.
  • Removes registry-generated resolved URLs from 180 lockfile entries.
  • Preserves package versions, integrity hashes, metadata, and dependency relationships.

Confidence Score: 5/5

The PR appears safe to merge because it changes lockfile source metadata without altering dependency resolution or supported installation behavior.

No actionable failures remain; supported npm versions honor the new setting, and the lockfile diff is limited to registry URL removal with integrity and dependency data preserved.

Important Files Changed

Filename Overview
.npmrc Adds a supported npm setting that prevents registry URLs from being recorded in generated lockfiles.
package-lock.json Removes only npm registry resolved fields while preserving all dependency and integrity information.

Reviews (1): Last reviewed commit: "chore: keep lockfile registry-agnostic" | Re-trigger Greptile

@qbalin qbalin left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@peakematt
peakematt merged commit 18981dc into main Sep 11, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

5 participants