Skip to content

Document npm lockfile regeneration for external contributors #245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jackson Weber (JacksonWeber) merged 3 commits into from
Sep 16, 2026
Merged

Document npm lockfile regeneration for external contributors #245

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
86a0aa2
Make npm lockfile registry-neutral
JacksonWeber Sep 16, 2026
ba344c0
Document registry-neutral lockfile in changelog
JacksonWeber Sep 16, 2026
dd8149a
Document local lockfile regeneration and retain Microsoft feed lockfile
JacksonWeber Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

### Other Changes
- Consolidate Dependabot updates for Vitest 4.1.11, Hono 4.13.7, qs 6.16.0, fast-uri 3.1.7, actions/deploy-pages 5.0.1, and actions/checkout 7.0.1.
- Document local npm lockfile regeneration for contributors who cannot access the Microsoft package proxy, while retaining the proxy-generated lockfile. [#245](https://github.com/microsoft/opentelemetry-distro-javascript/pull/245)

## [1.4.0] - 2026-09-08

Expand Down
32 changes: 32 additions & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,38 @@ npm run lint
npm test
```

### Using package-lock.json

The committed `package-lock.json` is generated through Microsoft's package proxy.
Microsoft contributors are required to use this proxy so dependencies undergo
the required security and vulnerability policies. The lockfile can contain
registry and tarball URLs that are inaccessible outside Microsoft.

If you cannot access the proxy, generate a replacement lockfile for local use
with an accessible npm registry. Changing `--registry` alone on the existing
lockfile does not reliably replace recorded custom-registry tarball URLs; regenerate
the lockfile rather than manually editing those URLs.

Start in a fresh checkout without `node_modules`, or move the existing root
`node_modules` directory outside the checkout first. This prevents reuse of
installed packages and the hidden `node_modules/.package-lock.json`. Back up any
local lockfile changes, then remove only the root `package-lock.json` (using your
file manager or shell). From the repository root, generate and use a local
lockfile, for example with the public npm registry:

```bash
npm install --package-lock-only --ignore-scripts --registry=https://registry.npmjs.org/
npm ci --registry=https://registry.npmjs.org/
```

The first command resolves dependencies from `package.json` without installing
them; the second installs the generated lockfile normally. Scoped registry
settings, if configured, must also point to registries you can access.
Resolved versions may differ from the committed lockfile because of dependency
ranges and registry availability, including quarantine policies; this does not
guarantee the same dependency tree. Microsoft contributors must continue using
the required proxy rather than using this workflow to bypass its restrictions.

## Pull Requests

- Describe the problem and the approach clearly.
Expand Down
Loading