[ixuz]

What and why

Renovate's weekly lock file maintenance (#502) failed its renovate/artifacts check with EALLOWREMOTE for package-lock.json, e2e/pod/servers/pivot/package-lock.json and e2e/pod/servers/nss/6/package-lock.json:

Refusing to fetch "https://registry.npmjs.org/npm/-/npm-11.21.1.tgz"

Those are the lockfiles that hold the npm package. In the root one, @semantic-release/npm brings it in. npm 12 (packageManager: npm@12.2.1) fetches no package that a URL names (allow-remote=none). Yet --package-lock-only, which Renovate locks with, opens every package with bundled dependencies by its registry URL. It does so without the exemption a registry tarball gets elsewhere. This is an npm bug, npm/cli#9800, and its fix (npm/cli#9819) is in no release yet. A plain npm install is not affected. Neither is an update that keeps the lockfile, so only lock file maintenance, and any update that moves npm itself, hit it.

renovate.json5 now gives Renovate's npm allow-remote=all, with npmrcMerge: true. Renovate puts that line ahead of each directory's own .npmrc during its artifact updates, then restores the files. So the 3-day min-release-age and ignore-scripts still apply. Contributors' npm keeps npm 12's default. A test in scripts/renovateConfig.test.ts keeps npmrcMerge on: without it, Renovate would use its npmrc in place of the .npmrc files and lock without the 3-day wait. Both settings come out once an npm release fixes the issue.

Checked locally:

• With npm 12.2.1 and the merged settings, all three lockfiles lock again from scratch, and min-release-age still reads 3.
• Without the added line, the same run fails with EALLOWREMOTE.
• renovate-config-validator --strict (Renovate 44.188.2) accepts the config.

Once this is merged, tick the rebase/retry box on #502 so that Renovate runs its artifacts again.

Closes: #505

Checklist

• One issue. This pull request addresses one issue, linked above. (No issue: it fixes the failing check on Renovate's pull request fix(deps): lock file maintenance (npm) #502.)
• One step. This pull request does not finish its issue, so it says Refs:, not Closes:. Leave this unchecked otherwise.
• Done, as AGENTS.md defines it: npm run check passes (lint, Markdown and spelling included), npm run lint:reuse too if a file was added, and npm run crosscheck too if ns/ or decks/ changed. (No file added; ns/ and decks/ unchanged.)
• Tests. New and changed code has its tests, and every package stays at 100% coverage (docs/testing.md).
• Docs. The docs say what changed, and a new page in docs/ is listed in docs/docs.ttl. (n/a: the reason is in renovate.json5's comment, beside the setting; no page describes Renovate's npm settings.)
• Languages. A new or changed message is in every locale: en, sv, ko, de, es and fr (packages/ui/src/i18n/). (n/a: no message changed.)
• Vocabulary and shapes. Any change to ns/ was agreed in an issue first; no published ns/shapes/*/vN.ttl or decks/*/vN.ttl was edited; generated files were regenerated, not edited. (n/a: ns/ and decks/ unchanged.)
• Breaking? Nothing in the public API breaks, or a commit says so (! and a BREAKING CHANGE: footer). npm run check:breaking sees a line of api/ that goes, but not a feature removed, nor a reader that reads less than before.
• Pod data. Any change to what the app writes to a pod comes with its migration (docs/migrations.md). (n/a: the app is unchanged.)
• Policy. Any change to an external rule the code follows (SM-2, the plural rules, a specification) is cited. (npm's behavior is cited: [BUG] --dry-run fails with EALLOWREMOTE on registry tarballs for packages that declare bundleDependencies npm/cli#9800.)
• Licenses. New content is MIT, or a deck states its own license; a new file has its SPDX header (npm run lint:reuse), or a new deck its line in REUSE.toml; third-party content is credited. (n/a: no new file.)
• Architecture. Imports follow docs/boundaries.md and the layers of docs/architecture.md. (n/a: no import changed.)
• Run. I ran the app (npm run dev) and tried the change, and considered the user journeys. (n/a: Renovate configuration only; npm 12's lock run tried by hand instead.)
• Authorship. I read and understand every line of this pull request, and answer for it, whatever tools helped write it (CONTRIBUTING.md).
• Commits. Each commit is one logical change, in Conventional Commits form (type(scope): subject, ! and a BREAKING CHANGE: footer if it breaks something), with an imperative subject and a body that explains why (CONTRIBUTING.md).