dancefinder/dancefinder-app
5
0 Fork 0
Code Issues 1 Pull Requests 6 Actions Packages Projects Releases Activity

chore(renovate): pin npm to v11 for lockfile updates #3128

Merged
argoyle merged 1 commits from chore/renovate-npm-11 into main 2026-10-31 15:25:27 +00:00
Conversation 0 Commits 1 Files Changed 1
+2 -1
argoyle commented 2026-10-31 15:16:33 +00:00
Owner
Copy link
Copy source

Without an npm constraint Renovate installs the latest npm (12.2.1). npm 12 defaults to allow-remote=none, and when it reads a package that declares bundleDependencies it fetches the tarball by URL and then refuses it as "remote" (EALLOWREMOTE, open upstream bug npm/cli#9800). This broke the lockfile update of the nuxt 4.6.3 security PR in shiny/frontend (#3808); the same can hit this repo on any bump that pulls in such a package.

This adds "npm": "^11" to Renovate's constraints, the npm that Node 24 ships. Drop it once npm/cli#9800 is fixed. Same change as shiny/frontend#3809.

Trivial config change, so no expert review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a

Without an npm constraint Renovate installs the latest npm (12.2.1). npm 12 defaults to `allow-remote=none`, and when it reads a package that declares `bundleDependencies` it fetches the tarball by URL and then refuses it as "remote" (`EALLOWREMOTE`, open upstream bug npm/cli#9800). This broke the lockfile update of the nuxt 4.6.3 security PR in shiny/frontend (#3808); the same can hit this repo on any bump that pulls in such a package. This adds `"npm": "^11"` to Renovate's `constraints`, the npm that Node 24 ships. Drop it once npm/cli#9800 is fixed. Same change as shiny/frontend#3809. Trivial config change, so no expert review. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a
argoyle added 1 commit 2026-10-31 15:16:33 +00:00
chore(renovate): pin npm to v11 for lockfile updates
dancefinder-app / build (pull_request) Successful in 4m35s
Details
dancefinder-app / deploy-prod-frostmoln (pull_request) Skipped
Details
975d7322c6 
Renovate installs the latest npm (12.2.1) when unconstrained. npm 12 defaults to allow-remote=none and then refuses to read a package with bundleDependencies by its registry tarball URL (EALLOWREMOTE, npm/cli#9800), which breaks lockfile updates. npm 11 is what Node 24 ships. Drop the constraint once #9800 is fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a
argoyle scheduled this pull request to auto merge when all checks succeed 2026-10-31 15:16:34 +00:00
argoyle merged commit e31467a34e into main 2026-10-31 15:25:27 +00:00
argoyle deleted branch chore/renovate-npm-11 2026-10-31 15:25:27 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
javascript
security
Pull requests that address a security vulnerability
 severity:critical
severity:high
severity:low
severity:moderate
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dancefinder/dancefinder-app#3128