fix(deps): let Renovate's npm lock lockfiles that hold npm again

renovate.json5

@@ -81,6 +81,18 @@
     pip_requirements: {
         enabled: false,
     },
+    // npm 12 fetches no package that a URL names (allow-remote), yet its
+    // --package-lock-only, which Renovate locks with, opens a package with
+    // bundled dependencies, such as npm itself, by the URL its registry
+    // gives: so it refuses to lock again every lockfile that holds npm
+    // (https://github.com/npm/cli/issues/9800). Renovate's npm alone
+    // fetches from URLs again, as npm 11 did, and the lockfile it writes
+    // is read by a person before it is merged (the npm rule below).
+    // npmrcMerge keeps each .npmrc's own settings, the 3-day wait among
+    // them, under this line: without it, Renovate would use this line in
+    // their place. Remove both once an npm release fixes the issue.
+    npmrc: 'allow-remote=all',
+    npmrcMerge: true,
     // Every Monday, Renovate locks the packages in each package-lock.json
     // again, to the newest version each range allows, so that the packages
     // the dependencies need get their fixes too: an update moves only the

scripts/renovateConfig.test.ts

@@ -26,6 +26,8 @@ type PackageRule = Record<string, unknown> & { automerge?: boolean };
 const config = JSON5.parse(readFileSync(join(ROOT, "renovate.json5"), "utf8")) as {
   automerge?: boolean;
   vulnerabilityAlerts?: Record<string, unknown>;
+  npmrc?: string;
+  npmrcMerge?: boolean;
   npm?: { lockFileMaintenance?: Record<string, unknown> };
   "pip-compile"?: { lockFileMaintenance?: Record<string, unknown> };
   packageRules: PackageRule[];
@@ -330,6 +332,13 @@ describe("renovate.json5", () => {
     expect(maintenance?.schedule).toEqual(["* 0-3 * * 1"]);
   });
 
+  it("keeps each .npmrc's settings under the npm settings it gives Renovate", () => {
+    // Without npmrcMerge, Renovate's npm would lock without the .npmrc
+    // files' 3-day wait (scripts/npmrc.test.ts).
+    expect(config.npmrc).toBe("allow-remote=all");
+    expect(config.npmrcMerge).toBe(true);
+  });
+
   it("keeps npm's weekly locking apart from pip-compile's monthly one", () => {
     // On one branch, the first manager's schedule and commit type would
     // be the branch's, and pip-compile's run would come every Monday.