From f06fccb9e2c1efbbde1188c8b7706270f6206a00 Mon Sep 17 00:00:00 2001
From: Joakim Olsson <joakim@unbound.se>
Date: Sat, 31 Oct 2026 16:16:22 +0100
Subject: [PATCH] chore(renovate): pin npm to v11 for lockfile updates

Renovate installs the latest npm (12.2.1) when unconstrained. npm 12 defaults to allow-remote=none and then refuses to read a package with bundleDependencies by its registry tarball URL (EALLOWREMOTE, npm/cli#9800), which breaks lockfile updates. npm 11 is what Node 24 ships. Drop the constraint once #9800 is fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a
---
 renovate.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 98ddb53..7488973 100644
--- a/renovate.json
+++ b/renovate.json
@@ -20,5 +20,8 @@
         "stylelint-config-standard"
       ]
     }
-  ]
+  ],
+  "constraints": {
+    "npm": "^11"
+  }
 }