Uncertainty in Dependabot's NPM Version

[joni3k]

There seems to be a discrepancy between the npm version Dependabot appears to be using and what is indicated by its logs. Based on this, the NPM version should be 9.6.5, but Dependabot's logs indicate the usage of version 10.2.4.

Specifically, our project setup enforces strict engine versions with the following configurations, resulting in errors when attempting to use Dependabot:

1. .npmrc with engine-strict=true
2. package.json specifying "engines": {"node": ">=20 <21", "npm": ">=10.2 <11"}

Dependabot fails with an error due to version mismatches:

dependency_file_not_resolvable {:message=>"Dependabot uses Node.js v20.11.1\n and NPM 10.2.4\n. Due to the engine-strict setting, the update will not succeed."}

This scenario forces a dilemma where we must allow older NPM versions than we would want, or disable strict engine versions altogether.

Dependabot's Node-version was bumped to v20 recently here.

Reproduction Steps

1. Set up a Node.js project with engine-strict=true in .npmrc and "engines": {"node": ">=20 <21", "npm": ">=10.2 <11"} in package.json.
2. Initiate a Dependabot update check.

Workaround

Disable engine-strict in .npmrc or adjust package.json to accept "npm": ">=9.6.5" to resolve the issue.

[yeikel]

From what I understand:

1. Dependabot is tested using the NPM version listed in the build
2. The version of NPM in the docker image is behind due to [BUG] npm removes invalid references instead of failing with an error starting in 9.6.6  npm/cli#6742

The error you're seeing is definitely confusing and the version of NPM cannot stay behind node for long as it will cause this confusion. I am trying to address it with #9213

[cedric-anne]

Yes, it is really confusing.

I have the same case with the following configuration:

    "engines": {
        "node": ">= 20.9",
        "npm": ">= 10.1"
    }

and it gives me this message: dependency_file_not_resolvable {:message=>"Dependabot uses Node.js v20.12.2\n and NPM 10.5.0\n. Due to the engine-strict setting, the update will not succeed."}.