[peakematt]

Public npm lockfiles should not pin registry download URLs because the install registry is environment-specific and can expose private infrastructure when serialized. This change configures omit-lockfile-registry-resolved=true so npm leaves registry-hosted resolved properties out of package-lock.json.

The regenerated lockfile removes exactly 454 registry HTTP(S) resolved properties while preserving all 454 integrity properties. Package keys, versions, dependency relationships, metadata, and non-registry resolutions are unchanged, so dependencies remain unchanged.

Verification confirmed zero semantic violations and no private registry references. git diff --check, a clean npm ci from https://registry.npmjs.org/ with a fresh cache, lint, formatting, type checking, and the production build all passed.

https://linear.app/workos/issue/HELP-722

[linear-code]

HELP-722

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
explore	Ready	Preview	Sep 9, 2026 9:27pm UTC

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Greptile Summary

This PR makes npm lockfile serialization registry-agnostic.

• Adds omit-lockfile-registry-resolved=true to .npmrc.
• Removes 454 registry-hosted resolved properties from package-lock.json.
• Preserves package versions, dependency metadata, relationships, and integrity hashes.

Confidence Score: 5/5

The PR appears safe to merge; it changes lockfile serialization without changing the dependency graph or package integrity verification.

The base and head lockfiles are semantically identical after excluding resolved fields, all 454 deletions are registry URLs, and no actionable changed-code failure remains.

Important Files Changed

Filename	Overview
.npmrc	Configures supported npm versions to omit registry-hosted resolved URLs when writing lockfiles.
package-lock.json	Removes only registry resolution URLs while preserving the lockfile’s dependency semantics and integrity metadata.

_{Reviews (1): Last reviewed commit: "chore: keep lockfile registry-agnostic" | Re-trigger Greptile}