unboundsoftware/schemas-app
6
0 Fork 0
Code Issues 1 Pull Requests 6 Actions Packages Projects Releases Activity

chore(renovate): pin npm to v11 for lockfile updates #417

Merged
argoyle merged 1 commits from chore/renovate-npm-11 into main 2026-10-31 15:25:35 +00:00
Conversation 0 Commits 1 Files Changed 1
+4 -1
argoyle commented 2026-10-31 15:16:34 +00:00
Owner
Copy link
Copy source

Without an npm constraint Renovate installs the latest npm (12.2.1). npm 12 defaults to allow-remote=none, and when it reads a package that declares bundleDependencies it fetches the tarball by URL and then refuses it as "remote" (EALLOWREMOTE, open upstream bug npm/cli#9800). This broke the lockfile update of the nuxt 4.6.3 security PR in shiny/frontend (#3808); the same can hit this repo on any bump that pulls in such a package.

This adds "npm": "^11" to Renovate's constraints, the npm that Node 24 ships. Drop it once npm/cli#9800 is fixed. Same change as shiny/frontend#3809.

Trivial config change, so no expert review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a

Without an npm constraint Renovate installs the latest npm (12.2.1). npm 12 defaults to `allow-remote=none`, and when it reads a package that declares `bundleDependencies` it fetches the tarball by URL and then refuses it as "remote" (`EALLOWREMOTE`, open upstream bug npm/cli#9800). This broke the lockfile update of the nuxt 4.6.3 security PR in shiny/frontend (#3808); the same can hit this repo on any bump that pulls in such a package. This adds `"npm": "^11"` to Renovate's `constraints`, the npm that Node 24 ships. Drop it once npm/cli#9800 is fixed. Same change as shiny/frontend#3809. Trivial config change, so no expert review. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a
argoyle added 1 commit 2026-10-31 15:16:34 +00:00
chore(renovate): pin npm to v11 for lockfile updates
schemas-app / build (pull_request) Successful in 4m34s
Details
schemas-app / deploy-prod-frostmoln (pull_request) Skipped
Details
f06fccb9e2 
Renovate installs the latest npm (12.2.1) when unconstrained. npm 12 defaults to allow-remote=none and then refuses to read a package with bundleDependencies by its registry tarball URL (EALLOWREMOTE, npm/cli#9800), which breaks lockfile updates. npm 11 is what Node 24 ships. Drop the constraint once #9800 is fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a
argoyle scheduled this pull request to auto merge when all checks succeed 2026-10-31 15:16:36 +00:00
argoyle merged commit da4e29fd6a into main 2026-10-31 15:25:35 +00:00
argoyle deleted branch chore/renovate-npm-11 2026-10-31 15:25:35 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
acctest (Shiny Acctest) argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unboundsoftware/schemas-app#417