Renovate suddenly updates npm and node to pinned versions for engines

[sceee]

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Github Actions - renovatebot/[email protected]; renovate version 37.302.0

Please tell us more about your question or problem

Hi,

I have an engines config in the package.json like this:

  "engines": {
    "node": "20",
    "npm": "10"
  },

This worked well before and renovate did not touch it until probably around 2 weeks ago.
It seems that since then (probably since an update of renovatebot/github-action by renovate), renovate started updating and pinning the engines versions (which is not what I want):

Reading through some issues here, it seems by default it is not intended that the engines should be pinned to specific versions except if you explicitly opt in for this.

I do not have enabled this explicitly in the config but I do have packageRules to limit npm and node to specific versions:

  {
      matchPackageNames: ["node", "@types/node"],
      allowedVersions: "^20.0.0",
    },
    { matchPackageNames: ["npm"], allowedVersions: "^10.0.0" },

I could not find a bug related to this created in the last few days but I could not find a cause in the configuration as it seems there was no related change in my configuration.

So I guess it was introduced in one of the recent renovate versions.
Or is there any new setting that needs to be set that renovate does not pin the engine versions?

Logs (if relevant)

Select me to see logs

DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (repository=my/repo, branch=auto-dep-update/node-20.x)
DEBUG: npm.updateDependency(): engines.node = 20.12.2 (repository=my/repo, branch=auto-dep-update/node-20.x)

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

To get started, please read our guide on creating a minimal reproduction.

Good luck,

The Renovate team

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

Read the Renovate docs, troubleshooting, self-hosted to learn how to find the logs.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[sceee]

If anyone else faces this:
This #13521 (reply in thread) helped me resolve it.
It seems somehow in my renovate config I created some group that caused the rangeStrategy to change for the engines updates.
Adding something like this (as mentioned in the above comment) resolves it.

{
      "description": "Don't bump engines field in package.json",
      "matchPackageNames": ["node"],
      "matchManagers": ["npm"],
      "matchDepTypes": ["engines"],
      "rangeStrategy": "auto"
    }