From 2fbcdbb59dd592f2564029657fd49b7449eb6d85 Mon Sep 17 00:00:00 2001
From: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
Date: Sat, 27 Jun 2026 08:42:19 -0700
Subject: [PATCH] fix(ci): pin Dependabot npm registry

---
 .npmrc       | 1 +
 CHANGELOG.md | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/.npmrc b/.npmrc
index b6f27f1..1d456dd 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,2 @@
 engine-strict=true
+registry=https://registry.npmjs.org/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 543e73d..a8ee5f3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ All notable changes to `@openclaw/libterminal` will be documented in this file.
 
 - Harden release and runtime validation for portable typechecking, browser smoke
   coverage, Ghostty asset discovery, and local stdio cleanup.
+- Pin dependency automation to the public npm registry so public scoped packages
+  do not resolve through GitHub Packages.
 
 ## 0.3.1 - 2026-06-19