build: hold dependencies back to versions the CFS feed can serve

[wenytang-ms]

Why

The nightly pipeline (16482) has been failing at npm install since package restore moved to the Central Feed Service feed. Build 31836658:

npm error code E404
npm error 404 Not Found - GET https://pkgs.dev.azure.com/mseng/VSJava/_packaging/vscjava/npm/registry/webpack/-/webpack-5.109.0.tgz
npm error 404 Cannot find the file webpack-5.109.0.tgz in package 'webpack 5.109.0' in feed 'vscjava'

The CFS steps themselves are fine — npm config shows the registry correctly pointed at the feed, and authentication succeeds. The failure is in what the feed will hand back.

Root cause

The feed is not broken or stale. It mirrors npmjs on demand and does so correctly (nanoid in the feed is already at 6.0.0, matching npmjs). What it does is withhold upstream versions younger than roughly 7 days, so that packages are scanned before anyone can consume them.

Probing the feed on 2026-07-29 puts the boundary within 0.07 days:

package	age when probed	served by feed
typescript@7.1.0-dev.20260722.1	6.71 days	no
vite@8.2.0-beta.0	6.78 days	yes

Scope

Rolling back webpack alone would not have fixed the build. Checking all 289 versions pinned in package-lock.json against the feed found four inside the window — the build would simply have failed on the next one:

package	pinned	published	servable from	rolled back to
webpack	5.109.0	2026-07-23	2026-07-30	5.108.4
postcss	8.5.23	2026-07-24	2026-07-31	8.5.21
sass	1.102.0	2026-07-25	2026-08-01	1.101.3
fs-extra	11.4.0	2026-07-23	2026-07-30	11.3.6

Each moves to the newest release the feed already carries. Re-running the sweep afterwards: 291/291 pinned versions resolve against the feed.

Preventing the recurrence

All four bumps came from Dependabot. Its built-in cooldown is 3 days — shorter than the feed's window — so it will keep proposing versions that cannot be built, and this breakage will repeat every few days. cooldown.default-days: 7 in .github/dependabot.yml closes that gap; the rollback on its own would not.

Notes

• resolved URLs in the lockfile still point at registry.npmjs.org. Cloning and building this public repository needs no internal access, and no internal feed URL is committed.
• Two transitive dependencies (acorn-import-phases, loader-runner) appear in the lockfile because webpack 5.108.4 declares them where 5.109.0 did not. Both are servable by the feed.
• All peer ranges still hold — webpack-cli@7.2.1 requires webpack@^5.101.0.
• The four versions rolled back here become servable between 2026-07-30 and 2026-08-01, at which point Dependabot may legitimately re-propose them.

Validation

npm ci followed by npm run build:

assets    (webpack 5.108.4) compiled with 6 warnings in 48803 ms
extension (webpack 5.108.4) compiled successfully in 48786 ms