Renovate drops dev=true for npm transitive dependency #33745
Replies: 1 comment 5 replies
-
|
Renovate is not doing this itself - npm is doing this. Unless you think renovate is running an incorrect npm command, there's nothing renovate can do about this. |
Beta Was this translation helpful? Give feedback.
-
In a way I think it does, but it's due to the limitation from Both, Renovate and Dependabot, use The expected behaviour for the the use case shared in this discussion can be achieved via ❯ npm update --no-audit --ignore-scripts --no-fund npmIt will only produce the change to the lock file, since The limitation is, that Renovate has its own configuration and |
Beta Was this translation helpful? Give feedback.
-
|
That describes an npm bug for lock file updates. If |
Beta Was this translation helpful? Give feedback.
-
|
I have to disagree. There is nothing unexpected in results we receive from We deal with a transitive dependency, which means it's listed neither in When we run I don't know if Renovate is expected to handle updates for the transitive dependencies in this manner, because I couldn't find any other PRs for transitive dependencies unless caused by vulnerability. To me it looks like Renovate have some special handling for |
Beta Was this translation helpful? Give feedback.
-
|
Please share the debug logs from when this change is made, and I'll take a deeper look |
Beta Was this translation helpful? Give feedback.
-
|
Added to the description. Thanks. |
Beta Was this translation helpful? Give feedback.
-
How are you running Renovate?
Self-hosted Renovate
If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.
self-hosted on GitHub Enterprise, v39.120.3
Please tell us more about your question or problem
Overview
v22.13.110.9.2v39.120.3Problem
Renovate updates
package-lock.jsonfile for thenpmtransitive dev dependency by moving it underdependenciesand dropping"dev": trueflag.Steps to reproduce
Node.js project has a single dev dependency:
@semantic-release/npm, which on its own depends onnpm. We intentionally start with the outdatednpm, so Renovate could pick up the change.After the initial installation
package-lock.jsonlooks something like this:When Renovate picks up the change for
npmit moves it under thedependenciesand drops the"dev": trueflag for the lock file:{ "packages": { "": { + "dependencies": { + "npm": "^10.9.2" + }, "devDependencies": { "@semantic-release/npm": "^12.0.0" }, // ... }, "node_modules/npm": { + "version": "10.9.2", - "dev": true, // ... }, // ... } }Effect on consumer
This change seems to have a minimum effect on the end user, since
npmfixes produced by Renovate inaccuracy during the installation.Both:
and
will revert the unwanted change. While
npm ci --omit=devdoes it silently,npm prunewill mutate thepackage-lock.json.Logs (if relevant)
Logs
Beta Was this translation helpful? Give feedback.
All reactions