From 5d154e30164ee65ce34d161b9609e08eabfae1b7 Mon Sep 17 00:00:00 2001 From: Austen Stone Date: Thu, 20 Aug 2026 10:41:21 -0700 Subject: [PATCH] fix: resolve every dependency from npmjs.org, not a corporate mirror 34 entries in package-lock.json pointed at Microsoft-internal Azure DevOps feeds (ms-feed-*.pkgs.visualstudio.com) instead of npmjs.org. They were written by npm install running behind a machine-level registry proxy, and most of them arrived with the security bumps in 04bc0ae, so the fix for the advisories quietly shipped the mirror too. The feed is publicly readable, which is why CI never went red. It is still wrong: a public repo should not route anyone's install through another company's infrastructure, and it splits the trust root for exactly the packages that were bumped to fix advisories. The tarballs are byte-identical, so only the URL host changes. npm ci against npmjs.org re-verifies all 310 integrity hashes unchanged. .npmrc pins the registry so the same proxy can't rewrite these URLs again the next time anyone runs npm install on a configured machine. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3cf40db0-fafb-4793-92c6-3fe2b92d70bd --- .npmrc | 3 +++ package-lock.json | 68 +++++++++++++++++++++++------------------------ 2 files changed, 37 insertions(+), 34 deletions(-) create mode 100644 .npmrc diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..1d959db --- /dev/null +++ b/.npmrc @@ -0,0 +1,3 @@ +# Pin the public registry so a machine-level or corporate proxy can't write its +# own resolved URLs into package-lock.json and ship them to everyone else. +registry=https://registry.npmjs.org/ diff --git a/package-lock.json b/package-lock.json index 1437446..7493c42 100644 --- a/package-lock.json +++ b/package-lock.json @@ -117,7 +117,7 @@ }, "node_modules/@babel/code-frame": { "version": "7.29.7", - "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/code-frame/-/code-frame-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz", "integrity": "sha1-8vu/6ofESiFZDsUVt3iywm2IZuc=", "dev": true, "license": "MIT", @@ -132,7 +132,7 @@ }, "node_modules/@babel/compat-data": { "version": "7.29.7", - "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/compat-data/-/compat-data-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz", "integrity": "sha1-bwI38PNtLlHAVwpjb67Z0tDv5ik=", "dev": true, "license": "MIT", @@ -142,7 +142,7 @@ }, "node_modules/@babel/core": { "version": "7.29.7", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/core/-/core-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz", "integrity": "sha1-gMELFySAgpaLV6hXuRZAlx8gcPc=", "dev": true, "license": "MIT", @@ -173,7 +173,7 @@ }, "node_modules/@babel/generator": { "version": "7.29.8", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/generator/-/generator-7.29.8.tgz", + "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz", "integrity": "sha1-SwuIeIVCJkMzngkCIUikxOuqSXk=", "dev": true, "license": "MIT", @@ -190,7 +190,7 @@ }, "node_modules/@babel/helper-compilation-targets": { "version": "7.29.7", - "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz", "integrity": "sha1-eh3vcEMCQBxH9k+oVYnpdK4hcEI=", "dev": true, "license": "MIT", @@ -207,7 +207,7 @@ }, "node_modules/@babel/helper-globals": { "version": "7.29.7", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-globals/-/helper-globals-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz", "integrity": "sha1-8EqW+9hHMkGxB5JD9bPwOjAQq3s=", "dev": true, "license": "MIT", @@ -217,7 +217,7 @@ }, "node_modules/@babel/helper-module-imports": { "version": "7.29.7", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz", "integrity": "sha1-7yUEilGOgo1zk/rFiC3dc5Idc5Y=", "dev": true, "license": "MIT", @@ -231,7 +231,7 @@ }, "node_modules/@babel/helper-module-transforms": { "version": "7.29.7", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz", "integrity": "sha1-sGJ0elmXuhOGNyATKLv/d5YFdK4=", "dev": true, "license": "MIT", @@ -249,7 +249,7 @@ }, "node_modules/@babel/helper-string-parser": { "version": "7.29.7", - "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", "integrity": "sha1-fwhx2Zgk0jE31g+G/PYTD9WhtR8=", "dev": true, "license": "MIT", @@ -259,7 +259,7 @@ }, "node_modules/@babel/helper-validator-identifier": { "version": "7.29.7", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz", "integrity": "sha1-vYcITO0MeW7Ea9pJLeboPSnon8I=", "dev": true, "license": "MIT", @@ -269,7 +269,7 @@ }, "node_modules/@babel/helper-validator-option": { "version": "7.29.7", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz", "integrity": "sha1-zzFb6UAhOzVOtKvMC9Aevj9zvCo=", "dev": true, "license": "MIT", @@ -279,7 +279,7 @@ }, "node_modules/@babel/helpers": { "version": "7.29.7", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helpers/-/helpers-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz", "integrity": "sha1-Rav951SJl+NDdsPmn+tHXP+0pgc=", "dev": true, "license": "MIT", @@ -293,7 +293,7 @@ }, "node_modules/@babel/parser": { "version": "7.29.8", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/parser/-/parser-7.29.8.tgz", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz", "integrity": "sha1-llNxai8Qxne5j7xj1L+wAMMCzxc=", "dev": true, "license": "MIT", @@ -318,7 +318,7 @@ }, "node_modules/@babel/template": { "version": "7.29.7", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/template/-/template-7.29.7.tgz", + "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz", "integrity": "sha1-TZ1ABPZFzdME3pWMclFieE7KxwA=", "dev": true, "license": "MIT", @@ -333,7 +333,7 @@ }, "node_modules/@babel/traverse": { "version": "7.29.8", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/traverse/-/traverse-7.29.8.tgz", + "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz", "integrity": "sha1-QREBTNxxoPldlHGQdZC6oLimsoo=", "dev": true, "license": "MIT", @@ -352,7 +352,7 @@ }, "node_modules/@babel/types": { "version": "7.29.8", - "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/types/-/types-7.29.8.tgz", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz", "integrity": "sha1-Einu8x2FFW1w+j9M2Fk3bQ6vaGM=", "dev": true, "license": "MIT", @@ -926,7 +926,7 @@ }, "node_modules/@oddbird/css-anchor-positioning/node_modules/nanoid": { "version": "5.1.16", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/nanoid/-/nanoid-5.1.16.tgz", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.16.tgz", "integrity": "sha1-/jRcCh+QB8Mvu1wTnhIIv9P0Hvc=", "funding": [ { @@ -1945,7 +1945,7 @@ }, "node_modules/baseline-browser-mapping": { "version": "2.11.14", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/baseline-browser-mapping/-/baseline-browser-mapping-2.11.14.tgz", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.14.tgz", "integrity": "sha1-1Ru5IoVgiw5jVoQaLup2hCp3HVI=", "dev": true, "license": "Apache-2.0", @@ -1968,7 +1968,7 @@ }, "node_modules/brace-expansion": { "version": "1.1.18", - "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/brace-expansion/-/brace-expansion-1.1.18.tgz", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", "integrity": "sha1-POdNiYhRNr4VNTQfjD1EJcKaXKs=", "dev": true, "license": "MIT", @@ -1979,7 +1979,7 @@ }, "node_modules/browserslist": { "version": "4.28.8", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/browserslist/-/browserslist-4.28.8.tgz", + "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz", "integrity": "sha1-o8ec63AChSfl2n2vyIfzIAtRaMA=", "dev": true, "funding": [ @@ -2023,7 +2023,7 @@ }, "node_modules/caniuse-lite": { "version": "1.0.30001809", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/caniuse-lite/-/caniuse-lite-1.0.30001809.tgz", + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001809.tgz", "integrity": "sha1-5s9x8U3f4AjxFN0qhGkjvjwDoHs=", "dev": true, "funding": [ @@ -2245,7 +2245,7 @@ }, "node_modules/electron-to-chromium": { "version": "1.5.405", - "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/electron-to-chromium/-/electron-to-chromium-1.5.405.tgz", + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.405.tgz", "integrity": "sha1-I/FCADNDlaCAG3n8NxqG2vAv014=", "dev": true, "license": "ISC" @@ -2272,7 +2272,7 @@ }, "node_modules/escalade": { "version": "3.2.0", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/escalade/-/escalade-3.2.0.tgz", + "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz", "integrity": "sha1-ARo/aYVroYnf+n3I/M6Z0qh5A+U=", "dev": true, "license": "MIT", @@ -2888,7 +2888,7 @@ }, "node_modules/js-yaml": { "version": "4.3.1", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/js-yaml/-/js-yaml-4.3.1.tgz", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", "integrity": "sha1-ASFsAB1n9I4s1WDXCMevIQkKOEg=", "dev": true, "funding": [ @@ -2962,7 +2962,7 @@ }, "node_modules/jsesc": { "version": "3.1.0", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jsesc/-/jsesc-3.1.0.tgz", + "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz", "integrity": "sha1-dNM1ojT2ftGZB/2t+sfM+dQJgl0=", "dev": true, "license": "MIT", @@ -3329,7 +3329,7 @@ }, "node_modules/lru-cache": { "version": "5.1.1", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lru-cache/-/lru-cache-5.1.1.tgz", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz", "integrity": "sha1-HaJ+ZxAnGUdpXa9oSOhH8B2EuSA=", "dev": true, "license": "ISC", @@ -3435,7 +3435,7 @@ }, "node_modules/nanoid": { "version": "3.3.18", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/nanoid/-/nanoid-3.3.18.tgz", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", "integrity": "sha1-9mot4Rmf/eD88hyKXxMQaxwIGRM=", "dev": true, "funding": [ @@ -3461,7 +3461,7 @@ }, "node_modules/node-releases": { "version": "2.0.53", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/node-releases/-/node-releases-2.0.53.tgz", + "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.53.tgz", "integrity": "sha1-D+Wtink14HUXL1dOVvDCDwf6Qa8=", "dev": true, "license": "MIT", @@ -3626,7 +3626,7 @@ }, "node_modules/postcss": { "version": "8.5.26", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss/-/postcss-8.5.26.tgz", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", "integrity": "sha1-bnUTV4DH4Q3zQzvyJmxVLTXIxiA=", "dev": true, "funding": [ @@ -3875,7 +3875,7 @@ }, "node_modules/semver": { "version": "6.3.1", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz", + "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=", "dev": true, "license": "ISC", @@ -4326,7 +4326,7 @@ }, "node_modules/typescript-eslint/node_modules/brace-expansion": { "version": "5.0.9", - "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/brace-expansion/-/brace-expansion-5.0.9.tgz", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", "integrity": "sha1-fHJDiAm1+lur9UGZofHCgaaYT88=", "dev": true, "license": "MIT", @@ -4378,7 +4378,7 @@ }, "node_modules/undici": { "version": "7.29.0", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/undici/-/undici-7.29.0.tgz", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", "integrity": "sha1-rg9vYuBuBXqcu3srX94rt095G48=", "dev": true, "license": "MIT", @@ -4395,7 +4395,7 @@ }, "node_modules/update-browserslist-db": { "version": "1.3.1", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz", + "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz", "integrity": "sha1-pxwo3SL1BUgdvEaJCHsY2TPpCv0=", "dev": true, "funding": [ @@ -4704,7 +4704,7 @@ }, "node_modules/yallist": { "version": "3.1.1", - "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/yallist/-/yallist-3.1.1.tgz", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz", "integrity": "sha1-27fa+b/YusmrRev2ArjLrQ1dCP0=", "dev": true, "license": "ISC"