@@ -47,6 +47,12 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
 
+      # Install a new enough version of `npm` to understand `min-release-age`
+      # that is still compatible with Node 20.
+      - name: Install newer npm
+        if: matrix.node-version == 20
+        run: npm install -g npm@11.19.1
+
       - name: Install dependencies
         run: |
           # Use the system Bash shell to ensure we can run commands like `npm ci`
@@ -95,6 +101,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Check for incorrect addresses in package-lock.json
+        run: |
+          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
+              'package-lock.json'; then
+            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
+            exit 1
+          fi
+
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

@@ -221,6 +221,12 @@ const languageSetups: LanguageSetups = {
           cache: "npm",
         },
       },
+      // Install a new enough version of `npm` to understand `min-release-age`
+      // that is still compatible with Node 20.
+      {
+        name: "Install newer npm",
+        run: "npm install -g npm@11.19.1",
+      },
       {
         name: "Install dependencies",
         run: "npm ci",