Omit registry URLs from the npm lockfile

[Jamie Magee (JamieMagee)]

What changed

Added a project-level .npmrc with omit-lockfile-registry-resolved=true and regenerated package-lock.json with npm 10.9.4.

Why

The lockfile recorded Azure Artifacts proxy URLs in each registry dependency's resolved field. Those URLs depend on the registry used when the lockfile is generated. The npm setting keeps future lockfile updates independent of that registry.

Dependency versions, integrity hashes, and lockfileVersion are unchanged. npm will resolve registry tarball URLs from the configured registry during installation.

Validation

• npx --yes npm@10.9.4 config get omit-lockfile-registry-resolved
• npx --yes npm@10.9.4 install --package-lock-only --ignore-scripts
• Repeated lockfile generation and confirmed a clean result
• npx --yes npm@10.9.4 ci --ignore-scripts
• npm run db:generate
• TZ=UTC npm test (101 tests passed)
• npm run lint

This change does not affect application behavior, security, privacy, accessibility, deployment, or cost. It does not add registry credentials or authentication settings.

npm config reference: https://docs.npmjs.com/cli/v8/using-npm/config#omit-lockfile-registry-resolved

[Vlad G (vladpm)]

Thanks Jamie Magee (@JamieMagee). Good catch. Confirmed change is limited to stripping registry-specific resolved URLs and project .npmrc keeps future lockfile updates registry-agnostic.

Approving and applying the same omit-lockfile-reigstry-resolved setting on our other active branches so whole repo stays consistent.