Repository navigation
Use PackageFeedProxy for npm and Yarn restores - #404
Merged
Vladimir Morozov (vmoroz) merged 1 commit intoNov 4, 2026
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
Hosted Dependabot compatibility remains unverified because local restores do not confirm that hosted updates honor the proxy configuration and produce lockfiles compatible with the new download-URL restrictions.
No open issues 🎉
What changed in this PR
Switches npm and Yarn restores to Microsoft’s anonymous PackageFeedProxy to address uncached-package failures on the previous feed, without changing dependency versions or NuGet feeds.
Changes:
- Updates package projects, CI, standalone helpers, and documentation to use the proxy while retaining the eight-day dependency gates.
- Strengthens lockfile validation to reject literal and encoded download URLs, with additional regression tests.
- Makes native builds refresh their copied npm configuration when the source changes.
| File | Description |
|---|---|
unittests/NodeApi/test/CMakeLists.txt |
Tracks source .npmrc changes to refresh the build copy. |
unittests/NodeApi/test/.npmrc |
Selects the proxy for Node-API test dependencies. |
tools/hermes-parser/js/scripts/build-prettier.sh |
Uses the proxy for Prettier’s Yarn restore. |
tools/hcdp/.npmrc |
Selects the proxy for hcdp dependencies. |
tools/fork-sync/.npmrc |
Selects the proxy for fork-sync dependencies. |
test/SourceMap/translator/README.md |
Documents proxy-backed installation commands. |
test/circleci-e2e/run.sh |
Routes React Native and Hermes installs through the proxy. |
benchmarks/widgets/single-file/es5/.npmrc |
Selects the proxy for single-file widget dependencies. |
benchmarks/widgets/original/es5/.npmrc |
Selects the proxy for original widget dependencies. |
benchmarks/raytracer/original/.npmrc |
Selects the proxy for raytracer dependencies. |
.yarnrc.yml |
Switches Yarn’s registry while retaining its age gate. |
.github/dependabot.yml |
Clarifies feed and cooldown comments; update settings remain unchanged. |
.ado/scripts/README.md |
Documents anonymous restores and registry-independent lockfiles. |
.ado/scripts/npm-source-lint.ts |
Enforces the proxy and rejects Yarn download URLs. |
.ado/scripts/npm-source-lint.test.ts |
Adds registry and lockfile URL validation cases. |
.ado/scripts/.npmrc |
Selects the proxy for build-script dependencies. |
.ado/build-template.yml |
Sets CI’s npm registry to the proxy. |
Review effort: Balanced
Nikolai Aristov (NikoAri)
approved these changes
Nov 4, 2026
Benchmark ResultsTotal benchmarks: 204 Inputs: baseline/baseline.json, bench_result.json v8 (6176ms, 6269ms) +1.5%
test-suites (317886ms, 327067ms) +2.9%
micros (60876ms, 62405ms) +2.5%
jit-benches (8563ms, 7033ms) -17.9%
many-subclasses (73437ms, 78068ms) +6.3%
map-objects (3627ms, 3604ms) -0.6%
map-strings (4335ms, 4185ms) -3.5%
nbody (3448ms, 3127ms) -9.3%
string-switch (6503ms, 5684ms) -12.6%
raytracer (5608ms, 5648ms) +0.7%
MiniReact (30332ms, 29277ms) -3.5%
widgets (12934ms, 13150ms) +1.7%
|
Vladimir Morozov (vmoroz)
added a commit
that referenced
this pull request
Nov 4, 2026
Dependabot reads the committed .npmrc and .yarnrc.yml files. Since #404 they select PackageFeedProxy, which Dependabot's network does not allow, so every npm update fails with "egress not allowlisted packagefeedproxy.microsoft.io". Remove the registry from those files so that Dependabot resolves updates from the public npm registry, and route restores through the proxy from their environment instead: - CI sets NPM_CONFIG_REGISTRY and YARN_NPM_REGISTRY_SERVER for all jobs through .ado/npm-variables.yml. - .\dev sets the same variables unless the caller already set them. - The Node-API test build passes HERMES_NPM_REGISTRY, the proxy by default, to npm ci. npm-source-lint now checks every committed .npmrc and .yarnrc.yml, which Dependabot also reads from parent directories, and rejects any registry or credentials in them. Lockfiles, dependency versions, the 8-day age gates and NuGet are unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The old ADO feed fails anonymous restores for uncached packages. Switch npm and
Yarn to Microsoft's PackageFeedProxy without changing normal install commands,
dependency versions, or NuGet feeds.
and standalone helpers so installs need no credentials or new environment setup.
and encoded download URLs so lockfiles do not pin a download host. Dependabot
groups and lockfile-only updates stay unchanged.
so existing build trees pick up the new feed.
Test Plan
.\dev npm-source-lintandnpm --prefix .ado\scripts run test:npm-source-lint: passed, 47 tests.npm ci --no-audit --no-fund --maxsockets=8: passed in all seven npm projectswith empty npm user/global configuration and no registry override. The committed Yarn 4
release passed immutable installs in all five Yarn projects. All 12 lockfiles
stayed byte-for-byte unchanged.
.\dev build: passed, x64 Release, including the native npm restore.Hosted Dependabot has not yet been verified with this configuration.
Microsoft Reviewers: Open in CodeFlow