While not documented as such, it appears that the repository record is
required with trusted publishing of npm packages.
Test-bot: skip
Build-bot: skip
Some of the npm audit warnings left after #13897 require an updated `mocha` version to remedy. As we only really use `mocha` to do unit-testing, it should be safe to update if all of our existing tests pass with the new version.
Test-bot: skip