Npm version used by renovate

[GuillaumeRahbari]

I wanted to know what version of npm renovate is using when running.

I have a repository where I use nvm to determine the node version I want to use. I'm currently using node version 14.15.4 that should come with the version 6.14.10 of npm. But when renovate update the package-lock.json file, there was a big change in it as it now uses the lockfileVersion 2 whereas with npm 6 it should be using the lockfileVersion 1.
I think this change happened because renovate is using the latest npm version (that is the version 7). But it is only a guess and I would like to know how it works and how we could configure it :)

[viceice]

Which renovate are you using? we recently fixed the npm v7 issue.

fixed on v24.34.3 by #8506

So renovate will check the lockfile version and uses npm <7 if it's a v1 lockfile

[GuillaumeRahbari]

We are using the version 24.38.6. So I guess we should have the fix now.

But if I understand well, renovate will use npm 6 or 7 depending on the version present in the lockfile ? And not depending of the npm version that comes from the nvmrc file (the version of npm that comes with node) ?

Is there a way to tell renovate to use the npm version that comes with the node version installed ?

[rarkins]

You can control the npm version using engines.npm in package.json. There's no current way to say "use the default"

[GuillaumeRahbari]

Ok ! Thanks for your answers ! Help a lot.

[rarkins]

With the current approach you shouldn't find any example of incompatible lock files, e.g. caused by different versions of npm. If you do, then please discuss again so we can work out a way to fix that

[GuillaumeRahbari]

Ok ! Thanks again :)

[karfau]

I have the same issue and rebase/retry or recreating the PR using the Dependency Dashboard after it has been closed don't resolve the issue.
The repo is not public but I could provide read access for further analysis.
Is there any configuration required for the detection to work? (I didn't find anything when search the docs.)

[karfau]

from my package.json:

  "engines": {
    "node": ">=12",
    "npm": ">=6"
  },

[karfau]

I just realized that there is both a yarn.lock file and a package-lock.json file in the repo. even though we are not using yarn in the repo, the update to yarn.lock looks like it could work. Just want to mention it in case it might be related.

[karfau]

In my case there was some weird issue on github action runner side, even though the lock file is updated to v2, suddenly npm ci works again.
I would still like to know how if there is anything that I can do to prevent this change from happening.

[karfau]

After changing the engine like this:

  "engines": {
    "node": ">=12",
    "npm": "6"
  },

The Dependency Dashboard also lists an update to npm@7 and sticks with the existing lockfile version

[rarkins]

Needs reproduction in a public repo

[caiofbpa]

We're having this issue on a private repo at GitLab.

We're using renovate's GitLab CI template:

Not sure I can reproduce in a public repo.

[caiofbpa]

But now the npm version is correct, only the node version that's wrong:

[caiofbpa]

I'll try removing node from engines because it's not so relevant for dependency installation and updates

[viceice]

please provide the debug logs, so we can see what's going wrong. renovate should use the correct version of node.

[caiofbpa]

Removing node from engines worked. Renovate runs with a different node version, but our CI tests still run in the correct node version so we're covered.

[viceice]

sure, but i want to know whats going wrong. so you should normally not required to remove the node dependency

[aabmass]

I'm seeing a similar issue on this public repo GoogleCloudPlatform/opentelemetry-operations-js#237. The package-lock.json files use lockfileVersion 2, but renovate is still generating PRs with the old format. Any ideas?

I don't want to set the npm version in package.json engines because this is a library.

[rarkins]

Hopeful solution: #8961

[aabmass]

@rarkins I believe this is the log but I don't see anything about npm version. If you cannot see the link, here is a gist of it

[aabmass]

@rarkins awesome, thank you for the quick PR! I'll let you know if it is fixed with that new version of renovate. I have noticed that lerna doesn't seem to use the same version of npm it is invoked (for example running npx npm@^7 install in that repo) but rather the global one.

[rarkins]

In our case it's not even using the npm in the path but instead doing it's own hunting for non and running from the directory where it comes preinstalled by node. We worked around that by forcing node 15 if Lerna is used and lockfileversion=2

[aabmass]

@rarkins I can confirm that PR fixed the issue, thank you again!