chore: update broken package-lock resolves

[aabmass]

Some package-lock.json files had were using an npm mirror from netflix that is no longer working. For example https://artifacts.netflix.com/api/npm/npm-netflix/@babel/code-frame/-/code-frame-7.0.0.tgz is broken and it should use registry.npmjs.org. So I ran:

perl -i -p -e 's/https:\/\/artifacts\.netflix\.com\/api\/npm\/npm-netflix/https:\/\/registry.npmjs.org/' `git ls-files **/package-lock.json`

and then was able to run npm install normally and everything completed alright.

[jsuereth]

Sorry, This was suppose dto say "how is this the failure mode? Deleted all package locks?" Should that be updated?

[punya]

Thanks for looking into this. Are we pulling from any mirrors other than registry.npmjs.org elsewhere in our lockfiles? I'm curious if the addition of netflix as a mirror was intentional, was reviewed in the appropriate way, and if we have safeguards to prevent accidental or malicious introduction of mirrors in future.

[aabmass]

Are we pulling from any mirrors other than registry.npmjs.org elsewhere in our lockfiles?

@punya not anymore:

$ pcregrep -h -o1 '\"resolved\": \"https:\/\/(.+?)\/' `git ls-files **/package-lock.json` | sort | uniq
registry.npmjs.org

I'm curious if the addition of netflix as a mirror was intentional, was reviewed in the appropriate way, and if we have safeguards to prevent accidental or malicious introduction of mirrors in future

This change was introduced ~2 years ago in #564. The author of the PR works at netflix and judging by this npm package, netflix devs probably are/were using a custom registry, either with --registry http://artifacts.netflix.com/api/npm/npm-netflix or probably in their npmrc file. I think this was commited by mistake and the URLs have just since broken. It doesn't look like we have any safeguards to prevent this in place, created #889.

Also want to point out that package-lock.json files are not distributed on npm when publishing so mirrors can't be maliciously introduced to users (could effect local builds of OC though)

@jsuerth I tried just deleting the package locks first and regenerating but this upgraded a bunch of dependencies and broke the build as well :( so I took the route of replacing the mirror URLs instead. The changes to other lockfiles is npm upgrading the to lockfile version 2 since I am using npm v7.