Repository navigation
Keep committed npm and Yarn configs registry-free for Dependabot - #405
Merged
Vladimir Morozov (vmoroz) merged 1 commit intoNov 4, 2026
Merged
Vladimir Morozov (vmoroz) merged 1 commit into
Vladimir Morozov (vmoroz) merged 1 commit into
Conversation
Dependabot reads the committed .npmrc and .yarnrc.yml files. Since microsoft#404 they select PackageFeedProxy, which Dependabot's network does not allow, so every npm update fails with "egress not allowlisted packagefeedproxy.microsoft.io". Remove the registry from those files so that Dependabot resolves updates from the public npm registry, and route restores through the proxy from their environment instead: - CI sets NPM_CONFIG_REGISTRY and YARN_NPM_REGISTRY_SERVER for all jobs through .ado/npm-variables.yml. - .\dev sets the same variables unless the caller already set them. - The Node-API test build passes HERMES_NPM_REGISTRY, the proxy by default, to npm ci. npm-source-lint now checks every committed .npmrc and .yarnrc.yml, which Dependabot also reads from parent directories, and rejects any registry or credentials in them. Lockfiles, dependency versions, the 8-day age gates and NuGet are unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues were identified for the changes moving registry selection out of committed npm and Yarn configurations.
No open issues 🎉
What changed in this PR
This PR addresses Dependabot failures introduced by #404 by removing registry settings from committed npm and Yarn configs while keeping PackageFeedProxy selected for CI, developer-wrapper, and native test restores.
Changes:
- Move registry selection to shared CI variables, scoped
.\devenvironment settings, and an explicit Node-API CMake option. - Extend source linting and tests to reject registries and credentials in all committed npm and Yarn configs.
- Document feed setup without changing lockfiles, dependency versions, age gates, or NuGet configuration.
| File | Description |
|---|---|
| unittests/NodeApi/test/CMakeLists.txt | Pass a configurable registry explicitly to npm ci. |
| unittests/NodeApi/test/.npmrc | Remove the committed registry setting. |
| tools/hcdp/README.md | Link package-feed setup instructions. |
| tools/hcdp/.npmrc | Remove the committed registry setting. |
| tools/fork-sync/.npmrc | Remove the committed registry setting. |
| dev.ps1 | Set default registry variables and restore the caller’s environment afterward. |
| benchmarks/widgets/single-file/es5/README.md | Link package-feed setup instructions. |
| benchmarks/widgets/single-file/es5/.npmrc | Remove the committed registry setting. |
| benchmarks/widgets/original/es5/README.md | Link package-feed setup instructions. |
| benchmarks/widgets/original/es5/.npmrc | Remove the committed registry setting. |
| benchmarks/raytracer/original/.npmrc | Remove the committed registry setting. |
| benchmarks/build-helpers/flow-bundler/README.md | Link package-feed setup instructions. |
| API/hermes/cdp/tools/hermes-inspector-msggen/README.md | Document feed setup before installing test dependencies. |
| AGENTS.md | Document the registry-free configuration requirement. |
| .yarnrc.yml | Remove the registry setting while retaining the age gate. |
| .github/dependabot.yml | Update explanatory comments only. |
| .ado/scripts/README.md | Explain registry selection and user setup. |
| .ado/scripts/npm-source-lint.ts | Check all committed npm and Yarn configs for registries and credentials. |
| .ado/scripts/npm-source-lint.test.ts | Cover registry rejection, parent configs, and shared-config diagnostics. |
| .ado/scripts/.npmrc | Remove the committed registry setting. |
| .ado/pr-pipeline.yml | Import shared registry variables. |
| .ado/npm-variables.yml | Define npm and Yarn proxy environment variables. |
| .ado/ci-pipeline.yml | Import shared registry variables. |
| .ado/build-template.yml | Remove the redundant job-level registry variable. |
Review effort: Balanced
Benchmark ResultsTotal benchmarks: 204 Inputs: baseline/baseline.json, bench_result.json v8 (6176ms, 6254ms) +1.3%
test-suites (317886ms, 307775ms) -3.2%
micros (60876ms, 61039ms) +0.3%
jit-benches (8563ms, 6236ms) -27.2%
many-subclasses (73437ms, 76295ms) +3.9%
map-objects (3627ms, 3623ms) -0.1%
map-strings (4335ms, 4327ms) -0.2%
nbody (3448ms, 2920ms) -15.3%
string-switch (6503ms, 6379ms) -1.9%
raytracer (5608ms, 5468ms) -2.5%
MiniReact (30332ms, 29621ms) -2.3%
widgets (12934ms, 12727ms) -1.6%
|
Vladimir Morozov (vmoroz)
enabled auto-merge (squash)
November 4, 2026 23:06
Nikolai Aristov (NikoAri)
approved these changes
Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since #404 the committed
.npmrcand.yarnrc.ymlfiles selectPackageFeedProxy. Dependabot reads those files but cannot reach the proxy, so
every npm update now fails with
egress not allowlisted packagefeedproxy.microsoft.io(run).
Keep the committed files registry-free and select the proxy where restores run,
as microsoft/react-native-windows#16548 does.
resolves updates from the public npm registry. Its own config only gets
updated comments.
.\dev: CI setsNPM_CONFIG_REGISTRYandYARN_NPM_REGISTRY_SERVERfor every job (.ado/npm-variables.yml), and.\devsets them when they are unset, so pipeline and developer restoreskeep using the proxy.
npm ci(
HERMES_NPM_REGISTRY, the proxy by default), so it does not depend on howthe build was started.
npm-source-lintnow checks every committed.npmrcand.yarnrc.yml, including ones Dependabot reads from parent directories, andrejects any registry or credentials in them. Lockfiles stay free of download
URLs, so the same lockfile restores from either registry.
setting for bare
npmandyarncommands.Lockfiles, dependency versions, the eight-day age gates, and NuGet are
unchanged.
Test Plan
.\dev npm-source-lint: passed, 12 projects, 0 violations.npm --prefix .ado\scripts run test:npm-source-lint: passed, 54 tests.npm ciin all seven npm projects andyarn install --immutablein all fiveYarn projects, with empty npm user/global config, cold caches, and the CI
registry variables: passed; no lockfile changed.
.\dev build(x64 Release) withNPM_CONFIG_REGISTRYset to an invalid URL:passed, so the Node-API restore uses its explicit proxy registry.
to the public npm and Yarn registries, which is what Dependabot will use.
Hosted Dependabot runs only on
main, so it is confirmed after merge.Microsoft Reviewers: Open in CodeFlow