Post upgrade tasks not running

[andrewscfc]

Hey again,

I've just tried to test out 'post upgrade tasks' to run npx npm-force-resolutions to apply temporary updates to security compromised sub-depedencies: https://www.npmjs.com/package/npm-force-resolutions

I've added the following config but the command dosn't seem to be executing.
andrewscfc/simorgh@6dd75cc

It is supposed to:

• run npx npm-force-resolutions to apply to the forced resolutions
• run npm install to correct some inconsistencies the force resolutions tool introduces (Don't modify package-lock.json during npm ci rogeriochaves/npm-force-resolutions#16)

Thanks for this great tool it is hugely improving our dependency management.

[viceice]

Which kind of renovate are you running? Post upgrade tasks need a bot config which is only available for self-hosting renovate.

[viceice]

You could use a github action to run on renovate branches and do a git amend to the existing commit.

[rarkins]

A couple of concerns: it's at version 0.0.3 but also not updated for 15 months. This would not normally be the type of metadata about a package that would encourage us to depend on it, although in a way this would be "use at your own risk" anyway.

[andrewscfc]

We had a look at the code ourselves, and we didn't identify any security concerns in it ourselves https://github.com/rogeriochaves/npm-force-resolutions/blob/master/src/npm_force_resolutions/core.cljs
Totally appreciate that's your judgement/decision of course!

I'd say having force resolutions functionality in renovate would be pretty compelling for what it's worth?

yarn has it as built in functionality and we are seriously considering moving to yarn for that reason: https://classic.yarnpkg.com/en/docs/selective-version-resolutions/

[rarkins]

Yes, I think Yarn resolutions is a much better idea. Open to the idea but still hesitant about an unmaintained 0.0.3 dependency..

[andrewscfc]

Thanks for talking this through with me, it's likely the direction we'll take