Address network isolation issues - #361
Merged
Vladimir Morozov (vmoroz) merged 1 commit intoAug 12, 2026
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s Node/Yarn dependency restore flow to route through the approved ms/react-native-public Azure DevOps feed (instead of direct npmjs.org access), aligning dependency restores with network isolation and supply-chain requirements.
Changes:
- Pin npm restores to the ADO feed by updating multiple
package-lock.jsonfiles and adding.npmrcfiles for affected tool/test directories. - Configure Yarn registry at the repo level via
.yarnrc, and update selected Yarn lockfile dependencies (e.g.,brace-expansion). - Update CI and automation: set npm registry-related env vars in
.ado/build-template.yml, and configure Dependabot to use the feed + run weekly.
Reviewed changes
Copilot reviewed 8 out of 14 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| utils/promise/yarn.lock | Updates brace-expansion entry in Yarn lockfile. |
| unittests/NodeApi/test/package-lock.json | Re-pins npm tarball resolved URLs to the ADO feed. |
| unittests/NodeApi/test/CMakeLists.txt | Copies .npmrc into build dir and switches install to npm ci. |
| unittests/NodeApi/test/.npmrc | Pins npm registry to the approved ADO feed for Node-API test toolchain. |
| tools/hermes-parser/js/yarn.lock | Updates brace-expansion entries in Yarn lockfile. |
| tools/hcdp/package-lock.json | Re-pins npm tarball resolved URLs to the ADO feed and updates brace-expansion. |
| tools/hcdp/.npmrc | Pins npm registry to the approved ADO feed for hcdp. |
| tools/fork-sync/package-lock.json | Re-pins npm tarball resolved URLs to the ADO feed for fork-sync. |
| tools/fork-sync/.npmrc | Pins npm registry to the approved ADO feed for fork-sync. |
| .yarnrc | Sets Yarn registry to the approved ADO feed at the repo level. |
| .github/dependabot.yml | Configures Dependabot to use the feed and reduces cadence to weekly with grouping. |
| .ado/scripts/package-lock.json | Re-pins npm tarball resolved URLs to the ADO feed for build scripts. |
| .ado/scripts/.npmrc | Pins npm registry to the approved ADO feed for ADO build scripts. |
| .ado/build-template.yml | Sets npm registry/cache-related env vars in CI to align restores with the feed. |
Files not reviewed (4)
- .ado/scripts/package-lock.json: Generated file
- tools/fork-sync/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Benchmark ResultsTotal benchmarks: 204 Inputs: baseline/baseline.json, bench_result.json v8 (6176ms, 7453ms) +20.7%
test-suites (317886ms, 316401ms) -0.5%
micros (60876ms, 61176ms) +0.5%
jit-benches (8563ms, 6362ms) -25.7%
many-subclasses (73437ms, 76816ms) +4.6%
map-objects (3627ms, 3639ms) +0.3%
map-strings (4335ms, 4368ms) +0.8%
nbody (3448ms, 2895ms) -16.0%
string-switch (6503ms, 6138ms) -5.6%
raytracer (5608ms, 5462ms) -2.6%
MiniReact (30332ms, 30003ms) -1.1%
widgets (12934ms, 12797ms) -1.1%
|
Vladimir Morozov (vmoroz)
enabled auto-merge (squash)
August 12, 2026 15:59
Danny van Velzen (dannyvv)
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace use of the
npmjs.comfeed with the publicms/react-native-publicfeed.Details
The PR addresses three security related issues to reduce supply-chain risks:
npmjs.com. Instead we must use an ADO feed so the security team can vet and hold new packages.We also update the
dependabotcadence to weekly to reduce number of created PRs.The
dependabotis going to batch multiple changes in weekly PRs.Microsoft Reviewers: Open in CodeFlow