Renovate still try to use NPM v7, despite i'm using the configuration "force.constraints.node"

[gremo]

I've read the documentation in order to use the "old" NPM v6 (the constraints setting).

My current renovate.json is the following:

• Original in my repo: https://github.com/gremo/nest-winston/blob/master/renovate.json
• Changes merged on 03/03/21: gremo/nest-winston@44d2bbb#diff-7b5c8955fc544a11b4b74eddb4115f9cc51c9cf162dbffa60d37eeed82a55a57

{
  "extends": [
    "config:base",
    ":disablePeerDependencies"
  ],
  "packageRules": [
    {
      "depTypeList": [
        "devDependencies"
      ],
      "rangeStrategy": "bump"
    }
  ],
  "force": {
    "constraints": {
      "node": "< 15.0.0"
    }
  }
}

I've received two new PRs and they still want to use the new NPM version (look at the diffs in package-lock.json:

• https://github.com/gremo/nest-winston/pull/310/files

What I'm doing wrong, why it's not working as documented?

[rarkins]

Remove your force statement (recommended), or add an npm constraint to it. Right now your forced constraints are overriding the detected npm constraint, so in the absence of any npm constraint the latest npm is being installed.

[gremo]

Sorry I'm pretty new to Renovate. You mean simply:

  "constraints": {
    "npm": "< 7"
  }

... instead of the force key?

[viceice]

no, completely remove that from renovate config

[viceice]

gremo/nest-winston#312

[gremo]

So kind! Thanks!

[viceice]

This is not a bug, because you override the detected constraints, renovate has no npm version, so it will install latest npm (as pointed by npmjs).

So best is to not use force override. Alternatively you need to add a npm constraint too.