Repository navigation
fix: Let Renovate rebuild npm lockfiles under npm 12 - #38
Merged
Merged
Conversation
Renovate's npm lockfile step failed on auth-ui and staff-portal: npm 12 refused a tarball from a host outside the configured registry (EALLOWREMOTE) and rejected overrides whose range Renovate left behind (EOVERRIDE). Rewrite tarball hosts to the configured registry, merged into each repository's own .npmrc, and bump an override's range with its version.
yahyafakhroji
requested review from
kevwilliams,
mattdjenkinson and
scotwells
November 6, 2026 00:36
scotwells
approved these changes
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Renovate's npm lockfile step fails under npm 12, so grouped npm updates open with a stale
package-lock.json. auth-ui #198 failed withEALLOWREMOTEwhen npm refused the@tailwindcss/oxide-wasm32-wasitarball, and auth-ui #200 failed withEOVERRIDEonjoibecause Renovate left the old range inoverrides. staff-portal #794 has the same out-of-sync lockfile.Solution
The preset now sets
npmrc: replace-registry-host=always, so npm fetches every tarball from the configured registry's host, which npm 12 allows by default.npmrcMerge: trueadds that line to a repository's own.npmrcinstead of replacing it, which keepslegacy-peer-depsin staff-portal andauto-install-peersin datum-ui. A new package rule bumps an npmoverridesrange together with its version.auth-ui tried both settings first in datum-cloud/auth-ui#201. After it merged, Renovate rebuilt datum-cloud/auth-ui#200 with a valid lockfile and bumped every override range. Install and build passed there, and the strict validator passes on this branch.
Refs datum-cloud/auth-ui#201
Refs datum-cloud/staff-portal#794