[PR #1986] [MERGED] fix(build): resolve rolldown from the npm registry in package-lock.json #4952

New issue

Closed

opened 2026-10-31 00:57:19 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:57:19 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1986
Author: @balkan16
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/12/2026
Merged by: @morluto

Base: main ← Head: fix/lockfile-npm-registry

📝 Commits (1)

220f43d fix(build): resolve rolldown from the npm registry in package-lock.json

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 package-lock.json (+1 -1)

📄 Description

Summary

package-lock.json resolves one package, rolldown@1.2.12, from a third-party mirror (mirrors.cloud.tencent.com) instead of registry.npmjs.org. Every other entry uses the public npm registry. npm ci fetches lockfile resolved URLs directly, so a clean install depends on that mirror being reachable.

No related issue; this is a one-line correction.

Problem and expected behavior

Trigger: npm ci on a clean checkout in an environment that can reach registry.npmjs.org but not mirrors.cloud.tencent.com (restricted egress, corporate proxy or registry allowlist).

Observed on main (b6651cb):

npm error 403 403 Forbidden - GET https://mirrors.cloud.tencent.com/npm/rolldown/-/rolldown-1.2.12.tgz

npm's usual workaround does not help here. npm ci --replace-registry-host=always rewrites the host but keeps the mirror's /npm/ path prefix, so it requests a URL that does not exist:

npm error 404 'rolldown@https://registry.npmjs.org/npm/rolldown/-/rolldown-1.2.12.tgz' is not in this registry.

Expected: the lockfile resolves every package from the npm registry, like all other entries.

Change and scope

Change the single resolved URL for node_modules/rolldown to https://registry.npmjs.org/rolldown/-/rolldown-1.2.12.tgz. Version and integrity are unchanged. Nothing else in the lockfile changes.

Not included: a guard that rejects non-registry resolved hosts. Happy to add one (for example in scripts/check-dependency-install.mjs) if you want it, in this PR or a follow-up.

Contract and boundary impact

Semantic owner and earliest changed stage: development dependency install (npm ci)
CLI and MCP/tool-catalog contract: none
Provider, bridge, target-format, or platform compatibility: none
Evidence, artifact, provenance, or reconstruction contract: none
Process execution, authorization, cleanup, or containment impact: none
Generated metadata, package, or installation impact: none for the published package (rolldown is a dev dependency); contributor installs no longer depend on the mirror

Evidence and regression coverage

Tests added or updated: none (lockfile data only)
Base reproduction or other evidence: the 403 and 404 outputs above, from a clean npm ci on b6651cb in a registry-only environment
Integrity check: the npm registry tarball hashes to sha512-8wafseiaG80xmXSfqidUNqZcylTlhmPZZt+za2m+js2sFZ8dTNlhIOV2WcbIPx2hgwPBJpEUGFAMZ9bgBBLTSQ==, identical to the lockfile integrity, so the artifact is byte-for-byte the same
User-visible CLI/MCP output: not applicable
Remaining proof gaps: not tested from an environment that can reach the mirror (behavior there is unchanged by construction)

Validation performed

npm ci on base b6651cb: fails with the 403 above
npm ci with this change, from an empty node_modules: passes (377 packages)
npm run build: passes
npm run check:fast: passes (typecheck, lint)

Compatibility, safety, and release

Breaking changes or migration steps: none
Real Hopper/Ghidra, browser, or OS coverage: not applicable
Package or release metadata impact: none
Security, privacy, process, or containment review: reduces supply-chain surface by fetching from the canonical registry; integrity hash unchanged

Review checklist

This PR addresses a concrete problem or an agreed enhancement.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths. (Lockfile data only; no behavior test applies.)
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q3rXQaLacJ7gNBRkp7DovF

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1986 **Author:** [@balkan16](https://github.com/balkan16) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/12/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/lockfile-npm-registry` --- ### 📝 Commits (1) - [`220f43d`](https://github.com/morluto/rea/commit/220f43d76dc6043354a52d6292433a59b740fd83) fix(build): resolve rolldown from the npm registry in package-lock.json ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+1 -1) </details> ### 📄 Description ## Summary `package-lock.json` resolves one package, `rolldown@1.2.12`, from a third-party mirror (`mirrors.cloud.tencent.com`) instead of `registry.npmjs.org`. Every other entry uses the public npm registry. `npm ci` fetches lockfile `resolved` URLs directly, so a clean install depends on that mirror being reachable. No related issue; this is a one-line correction. ## Problem and expected behavior Trigger: `npm ci` on a clean checkout in an environment that can reach `registry.npmjs.org` but not `mirrors.cloud.tencent.com` (restricted egress, corporate proxy or registry allowlist). Observed on `main` (b6651cb): ``` npm error 403 403 Forbidden - GET https://mirrors.cloud.tencent.com/npm/rolldown/-/rolldown-1.2.12.tgz ``` npm's usual workaround does not help here. `npm ci --replace-registry-host=always` rewrites the host but keeps the mirror's `/npm/` path prefix, so it requests a URL that does not exist: ``` npm error 404 'rolldown@https://registry.npmjs.org/npm/rolldown/-/rolldown-1.2.12.tgz' is not in this registry. ``` Expected: the lockfile resolves every package from the npm registry, like all other entries. ## Change and scope Change the single `resolved` URL for `node_modules/rolldown` to `https://registry.npmjs.org/rolldown/-/rolldown-1.2.12.tgz`. Version and `integrity` are unchanged. Nothing else in the lockfile changes. Not included: a guard that rejects non-registry `resolved` hosts. Happy to add one (for example in `scripts/check-dependency-install.mjs`) if you want it, in this PR or a follow-up. ## Contract and boundary impact - Semantic owner and earliest changed stage: development dependency install (`npm ci`) - CLI and MCP/tool-catalog contract: none - Provider, bridge, target-format, or platform compatibility: none - Evidence, artifact, provenance, or reconstruction contract: none - Process execution, authorization, cleanup, or containment impact: none - Generated metadata, package, or installation impact: none for the published package (`rolldown` is a dev dependency); contributor installs no longer depend on the mirror ## Evidence and regression coverage - Tests added or updated: none (lockfile data only) - Base reproduction or other evidence: the 403 and 404 outputs above, from a clean `npm ci` on b6651cb in a registry-only environment - Integrity check: the npm registry tarball hashes to `sha512-8wafseiaG80xmXSfqidUNqZcylTlhmPZZt+za2m+js2sFZ8dTNlhIOV2WcbIPx2hgwPBJpEUGFAMZ9bgBBLTSQ==`, identical to the lockfile `integrity`, so the artifact is byte-for-byte the same - User-visible CLI/MCP output: not applicable - Remaining proof gaps: not tested from an environment that can reach the mirror (behavior there is unchanged by construction) ## Validation performed - `npm ci` on base b6651cb: fails with the 403 above - `npm ci` with this change, from an empty `node_modules`: passes (377 packages) - `npm run build`: passes - `npm run check:fast`: passes (typecheck, lint) ## Compatibility, safety, and release - Breaking changes or migration steps: none - Real Hopper/Ghidra, browser, or OS coverage: not applicable - Package or release metadata impact: none - Security, privacy, process, or containment review: reduces supply-chain surface by fetching from the canonical registry; integrity hash unchanged ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. (Lockfile data only; no behavior test applies.) - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Q3rXQaLacJ7gNBRkp7DovF --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:57:19 +00:00