Skip to content

XS✔ ◾ Omit Registry URLs From Lockfile #852

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Muiris Woulfe (muiriswoulfe) merged 2 commits into from
Aug 27, 2026
Merged

XS✔ ◾ Omit Registry URLs From Lockfile #852

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f51ca55
build: omit registry URLs from lockfile
muiriswoulfe Aug 26, 2026
385c1f5
Merge branch 'main' into omit-lockfile-registry-urls
muiriswoulfe Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 5 additions & 12 deletions docs/dependency-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,18 +48,11 @@ instead of the proxy. All communication with the proxy and the Office feed uses
HTTPS.

During CI/CD builds, `npm ci` resolves dependencies from the lockfile, ensuring
reproducible builds.

Because the proxy and Office feed each front multiple backend hosts, the
`resolved` URLs recorded in [`package-lock.json`][packagelockjson] may reference
rotating Microsoft backend tarball hosts (matching the shard-based routing
behavior expected of these feeds) rather than a single, fixed hostname. This is
expected behavior, not a misconfiguration: the recorded host does not need to
match the registry hostname configured in the repository-root `.npmrc`, and it
must not be normalized or rewritten to a single shard. Reproducibility and
integrity are instead guaranteed by the exact pinned versions and `integrity`
hashes recorded for each package (see [Tracking](#tracking)), which are verified
on every install regardless of which backend host served the tarball.
reproducible builds. Both checked-in `.npmrc` files set
`omit-lockfile-registry-resolved=true`, so the lockfile does not record registry
tarball URLs. Reproducibility and integrity are guaranteed by the exact pinned
versions and `integrity` hashes recorded for each package (see
[Tracking](#tracking)), which npm verifies on every install.

## Tracking

Expand Down
9 changes: 4 additions & 5 deletions docs/security-assessment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,11 +110,10 @@ manipulation.
Microsoft Package Feed Proxy for root and task-local npm commands; Azure
Pipelines builds override this at runtime with an explicit Office npm feed
instead. Neither active pipeline path resolves dependencies by directly
configuring `registry.npmjs.org`. The rotating backend tarball hosts recorded
in `package-lock.json` are not treated as a fixed trust boundary; the pinned
version and integrity hash for each package are the actual integrity controls,
verified on every install regardless of which backend host serves the tarball
(see [Dependency Management][dependencymanagement]).
configuring `registry.npmjs.org`. Registry tarball URLs are omitted from
`package-lock.json`; the pinned version and integrity hash for each package are
the integrity controls that npm verifies on every install (see
[Dependency Management][dependencymanagement]).
- [CodeQL][codeql] analyzes the codebase for security vulnerabilities on every
pull request.
- Dependencies are updated through a controlled process during releases, using
Expand Down
Loading