Update .npmrc approach and locked dependencies

src/Components/WebAssembly/Authentication.Msal/src/Interop/.npmrc → .npmrc

@@ -1 +1,2 @@
 registry=https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
+always-auth=true

eng/scripts/CodeCheck.ps1

@@ -26,12 +26,16 @@ function LogError {
         [Parameter(Mandatory = $true, Position = 0)]
         [string]$message,
         [string]$FilePath,
+        [string]$LineNumber, # Ignored if -FilePath not specified.
         [string]$Code
     )
     if ($env:TF_BUILD) {
         $prefix = "##vso[task.logissue type=error"
         if ($FilePath) {
             $prefix = "${prefix};sourcepath=$FilePath"
+            if ($LineNumber) {
+                $prefix = "${prefix};linenumber=$LineNumber"
+            }
         }
         if ($Code) {
             $prefix = "${prefix};code=$Code"
@@ -40,7 +44,11 @@ function LogError {
     }
     $fullMessage = "error ${Code}: $message"
     if ($FilePath) {
-        $fullMessage += " [$FilePath]"
+        $fullMessage += " [$FilePath"
+        if ($LineNumber) {
+            $fullMessage += ":$LineNumber"
+        }
+        $fullMessage += "]"
     }
     Write-Host -f Red $fullMessage
     $script:errors += $fullMessage
@@ -68,7 +76,10 @@ try {
     # Ignore duplicates in submodules. These should be isolated from the rest of the build.
     # Ignore duplicates in the .ref folder. This is expected.
     Get-ChildItem -Recurse "$repoRoot/src/*.*proj" |
-    Where-Object { $_.FullName -notmatch 'submodules' -and $_.FullName -notmatch 'node_modules' } |
+    Where-Object {
+        $_.FullName -NotLike '*\submodules\*' -and $_.FullName -NotLike '*\node_modules\*' -and
+        $_.FullName -NotLike '*\bin\*' -and $_.FullName -NotLike '*\src\ProjectTemplates\*\content\*'
+    } |
     Where-Object { (Split-Path -Leaf (Split-Path -Parent $_)) -ne 'ref' } |
     ForEach-Object {
         $fileName = [io.path]::GetFileNameWithoutExtension($_)
@@ -79,6 +90,23 @@ try {
         }
     }
 
+    #
+    # Check for unexpected (not from dotnet-public-npm) yarn resolutions in lock files.
+    #
+
+    $registry = 'https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/'
+    Get-ChildItem src\yarn.lock -Recurse |
+    ForEach-Object FullName |
+    Where-Object {$_ -NotLike '*\node_modules\*'} |
+    ForEach-Object {
+        # -List to limit complaints to one per file.
+        Select-String '^  resolved ' $_ | Select-String -List -NotMatch $registry
+    } |
+    ForEach-Object {
+        LogError -filePath "${_.Path}" -lineNumber $_.LineNumber `
+            "Packages in yarn.lock file resolved from wrong registry. All dependencies must be resolved from $registry"
+    }
+
     #
     # Versions.props and Version.Details.xml
     #

src/Components/test/E2ETest/yarn.lock

@@ -37,9 +37,9 @@
     "@types/node" "*"
 
 "@types/node@*":
-  version "18.11.18"
-  resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/@types/node/-/node-18.11.18.tgz#8dfb97f0da23c2293e554c5a50d61ef134d7697f"
-  integrity sha1-jfuX8Nojwik+VUxaUNYe8TTXaX8=
+  version "18.13.0"
+  resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/@types/node/-/node-18.13.0.tgz#0400d1e6ce87e9d3032c19eb6c58205b0d3f7850"
+  integrity sha1-BADR5s6H6dMDLBnrbFggWw0/eFA=
 
 "@types/node@^13.1.7":
   version "13.13.52"
@@ -265,9 +265,9 @@ graceful-fs@^4.1.6, graceful-fs@^4.2.0:
   integrity sha1-FH06AG2kyjzhRyjHrvwofDZ9emw=
 
 http-cache-semantics@^4.0.0:
-  version "4.1.0"
-  resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz#49e91c5cbf36c9b94bcfcd71c23d5249ec74e390"
-  integrity sha1-SekcXL82yblLz81xwj1SSex045A=
+  version "4.1.1"
+  resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz#abe02fcb2985460bf0323be664436ec3476a6d5a"
+  integrity sha1-q+AvyymFRgvwMjvmZENuw0dqbVo=
 
 http2-wrapper@^1.0.0-beta.5.2:
   version "1.0.3"
@@ -377,9 +377,9 @@ minimatch@^3.1.1:
     brace-expansion "^1.1.7"
 
 minimist@^1.2.5:
-  version "1.2.7"
-  resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/minimist/-/minimist-1.2.7.tgz#daa1c4d91f507390437c6a8bc01078e7000c4d18"
-  integrity sha1-2qHE2R9Qc5BDfGqLwBB45wAMTRg=
+  version "1.2.8"
+  resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c"
+  integrity sha1-waRk52kzAuCCoHXO4MBXdBrEdyw=
 
 mkdirp@^1.0.4:
   version "1.0.4"