Renovate not using npm version that corresponds to Node version by default

[arichesson]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

Other (please specify)

Which version of Renovate are you using?

44.104.2

Please tell us more about your question or problem

Based on this issue Default npm to use default version from node, I expect renovate to use the npm version that corresponds to the matching node version defined in my project using a .nvmrc or .node-version file. I'm running renovate using the docker container to allow it to install npm versions using the binarySource:install option. I have not constrained the npm version using a constraint or engine file as is documented here. According to that github issue, it seems like the intent was that if no constraints are specified, renovate should choose to use the npm version that was shipped with the node version. This makes it consistent with how most node version managers work for local development.

See the following logs.
My package-lock file has "lockfileVersion": 3, I have a .node-version file with 24.21.0 as the contents. I have no engine or renovate npm constraints.
Renovate picked up version 24.21.0 from my node version. It installed node 24.21.0 AND npm 11.19.0, but then installed npm version 12.0.2 and used that version instead.

Summary

When no engine or constraints option is specified
AND I have specified a node constraint using a .node-version or .nvmrc file (node@24.21.0)

Expected:
renovate uses/installs the matching npm version that was shipped my node version (npm@11.19.0)

Actual:
renovate uses generic fallback constraint that resolves to latest npm version (npm@12.0.2)

Logs (if relevant)

Logs

DEBUG: Using node constraint "24.21.0" from website/.node-version (repository=[redacted], branch=renovate/major-eslint-monorepo)
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (repository=[redacted], branch=renovate/major-eslint-monorepo)
DEBUG: Using containerbase dynamic installs (repository=[redacted], branch=renovate/major-eslint-monorepo)
DEBUG: Resolved stable matching version (repository=[redacted], branch=renovate/major-eslint-monorepo)
       "toolName": "npm",
       "constraint": ">=7",
       "resolvedVersion": "12.0.2"
DEBUG: Executing command (repository=[redacted], branch=renovate/major-eslint-monorepo)
       "command": "install-tool node 24.21.0",
       "env": [
         "NPM_CONFIG_CACHE",
         "npm_config_store",
         "HOME",
         "PATH",
         "LC_ALL",
         "LANG",
         "CI",
         "CONTAINERBASE_CACHE_DIR"
       ]
DEBUG: exec completed (repository=[redacted], branch=renovate/major-eslint-monorepo)
       "durationMs": 866,
       "stdout": "[03:06:00.910] INFO (1843): Installing tool node@24.21.0...\n[03:06:00.960] INFO (1843): tool already installed\n    tool: \"node\"\n14.16.0 (Node v24.21.0)\n11.19.0\n0.36.0\n[03:06:01.511] INFO (1843): Install tool node succeeded in 608ms.\n",
       "stderr": ""
DEBUG: Executing command (repository=[redacted], branch=renovate/major-eslint-monorepo)
       "command": "install-tool npm 12.0.2",
       "env": [
         "NPM_CONFIG_CACHE",
         "npm_config_store",
         "HOME",
         "PATH",
         "LC_ALL",
         "LANG",
         "CI",
         "CONTAINERBASE_CACHE_DIR"
       ]
DEBUG: exec completed (repository=[redacted], branch=renovate/major-eslint-monorepo)
       "durationMs": 802,
       "stdout": "[03:06:01.778] INFO (1902): Installing npm npm@12.0.2...\n[03:06:01.829] INFO (1902): tool already installed\n    tool: \"npm\"\n12.0.2\n[03:06:02.313] INFO (1902): Install tool npm succeeded in 543ms.\n",
       "stderr": ""
DEBUG: Executing command (repository=[redacted], branch=renovate/major-eslint-monorepo)
       "command": "npm install --package-lock-only --no-audit --ignore-scripts",
       "env": [
         "NPM_CONFIG_CACHE",
         "npm_config_store",
         "HOME",
         "PATH",
         "LC_ALL",
         "LANG",
         "CI",
         "CONTAINERBASE_CACHE_DIR"
       ]

[Dotoryman]

Your expectation is reasonable, and the >=7 line is the important clue. The fix for #19044 shipped in 42.1.2. In the source for 44.104.2, getNpmConstraintFromPackageLock() returns a constraint for lockfile v1 or v2, but returns null for v3; when the resolved npm constraint is empty, the npm install step is omitted and the npm bundled with Node is used. So a v3 lockfile by itself should not produce install-tool npm 12.0.2.

Something is supplying the observed >=7 constraint. I'd check the effective Renovate config (including inherited/global presets and package rules), the package.json associated with website/package-lock.json, and any packageManager/engines.npm entry. The log shows which value won but not, in the excerpt, where it came from. If those are all absent, this looks like a regression worth reporting with a minimal public reproduction and the full debug log; I wouldn't describe it as intended behavior from .node-version.

For an immediate deterministic workaround, set an explicit npm constraint, e.g. "engines": { "npm": "11.19.0" } in that package's package.json, or Renovate's constraints.npm if you don't want to declare it as an application engine. That pins the lockfile writer to the npm version you tested, though you would need to update it deliberately when Node changes.

References: npm version configuration, v44.104.2 npm post-update source.

[arichesson]

I double and triple checked my repos for a hidden npm constraint, and I didn't see anything. Looking at the renovate source code, it seems like renovate will default to npm >=7 for lockFileVersion 3.

locked-versions.ts Line 93

else if (lockfileVersion === 3) {
  if (!packageFile.extractedConstraints?.npm) {
    npm = '>=7';
  }
}  

In the meantime, I set a package.json engine constraint to "npm": "^11". Downside is that renovate immediately tries to update it to "^12" 🤦‍♂️

[RahulGautamSingh]

@arichesson's analysis is right.

Set the constraint in your Renovate config instead of engines:

 {
   "constraints": {
     "npm": "^11"
   }
 }

constraints is checked before anything Renovate extracts from the repository. It is not a dependency, so Renovate does not open a PR to bump it, unlike engines.npm in package.json.

[arichesson]

The constraint set in my renovate config is not a good solution long term because it requires manual upgrades, something renovate is supposed to do for me. Setting it as a package.json engine setting would be fine as long as renovate kept the npm version matched with the node version. I'm finding that node 24 doesn't use the latest version of npm 11 and thus has minor variations in how the lock file is generated. As I said above, we rely on the .node-version file in our repo to set the node and npm version in both cli and on dev's local environment. I'm asking that the .node-version file should drive the renovate npm version by default as well.
Ideally, I want my engine npm version to be bumped locked step with my node version. Node 24.21.0 = npm 11.19.0, Node 26 = npm v11.20.0, etc. Or renovate should just use the npm version bundled with the node version when no other constraints are specified.