Skip to content

fix(frontend): allow npm 11 so Renovate can refresh the lock file - #8519

Merged
matthewelwell merged 1 commit into
mainfrom
fix/frontend-npm-overrides
Sep 14, 2026
Merged

fix(frontend): allow npm 11 so Renovate can refresh the lock file#8519
matthewelwell merged 1 commit into
mainfrom
fix/frontend-npm-overrides

Conversation

@matthewelwell

@matthewelwell matthewelwell commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Thanks for submitting a PR! Please check the boxes below:

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Contributes to #7697

Renovate silently fails to refresh frontend/package-lock.json (see #8518, which covers every other lock file). It deletes the lock file before regenerating, and npm 10 — which engines.npm pinned us to — can't resolve $-prefixed overrides from scratch:

npm error Unable to resolve reference $@types/react-dom

npm 11 resolves them correctly, and npm 10 is fine whenever a lock file is present, so normal installs and CI were never affected.

Widening the range lets Renovate pick npm 11. It does not force an upgrade — node 22 bundles npm 10, which still satisfies the range. The upper bound keeps us on a major we've verified.

The lock file records engines, so it's updated to match.

How did you test this code?

Against a copy of frontend/ using Renovate's toolchain (node 22.18.0):

  • npm 10.9.9 fails to regenerate the lock file from scratch; npm 11.5.2 succeeds
  • npm 10.9.9 re-resolves an npm 11-generated lock file to a byte-identical result, so mixed-version teams and CI stay consistent
  • the only change to the committed lock file is the engines line

🤖 Generated with Claude Code

@matthewelwell
matthewelwell requested a review from a team as a code owner September 14, 2026 11:02
@matthewelwell
matthewelwell requested review from kyle-ssg and removed request for a team September 14, 2026 11:02
@vercel

vercel Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
flagsmith-frontend-preview Ready Ready Preview Sep 14, 2026 11:24am UTC
flagsmith-frontend-staging Ready Ready Preview Sep 14, 2026 11:24am UTC
1 Skipped Deployment
Project Deployment Actions Updated
docs Ignored Ignored Preview Sep 14, 2026 11:24am UTC

Request Review

@github-actions github-actions Bot added the front-end Issue related to the React Front End Dashboard label Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e3371370-8f9f-4633-9a23-dbb46a13c0cf

📥 Commits

Reviewing files that changed from the base of the PR and between 57884a4 and 20935e1.

⛔ Files ignored due to path filters (1)
  • frontend/package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (1)
  • frontend/package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

📝 Walkthrough

Walkthrough

The frontend package now accepts npm versions >=10 <12 instead of 10.x. This permits npm major versions 10 and 11.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 20935

The package metadata broadens npm support as intended, with the supplied installation checks showing compatibility for npm 10 and 11.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the fix label Sep 14, 2026
@github-actions

github-actions Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-8519 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-api:pr-8519 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith:pr-8519 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8519 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-8519 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-e2e:pr-8519 Finished ✅ Skipped

@github-actions

github-actions Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
✅ private-cloud · depot-ubuntu-latest-arm-16 — run #20426 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  36.8 seconds
commit  20935e1
info  🔄 Run: #20426 (attempt 1)

🗂️ Previous results
✅ private-cloud · depot-ubuntu-latest-16 — run #20426 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  33.4 seconds
commit  20935e1
info  🔄 Run: #20426 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #20426 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  42.2 seconds
commit  20935e1
info  🔄 Run: #20426 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #20426 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  34.1 seconds
commit  20935e1
info  🔄 Run: #20426 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #20425 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  25 passed
skipped  1 skipped

Details

stats  26 tests across 19 suites
duration  1 minute, 37 seconds
commit  57884a4
info  🔄 Run: #20425 (attempt 1)

Skipped tests

firefox › tests/onboarding-tests.pw.ts › Onboarding › New user connects via the single-page onboarding flow @oss

✅ private-cloud · depot-ubuntu-latest-16 — run #20425 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  33.1 seconds
commit  57884a4
info  🔄 Run: #20425 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #20425 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  40 seconds
commit  57884a4
info  🔄 Run: #20425 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #20425 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  40.8 seconds
commit  57884a4
info  🔄 Run: #20425 (attempt 1)

@github-actions

github-actions Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Visual Regression

19 screenshots compared. See report for details.
View full report

@matthewelwell @claude
fix(frontend): allow npm 11 so Renovate can refresh the lock file
20935e1 
npm 10 cannot resolve $-prefixed override references when building a
lock file from scratch, failing with "Unable to resolve reference
$<name>". It resolves them correctly whenever a lock file is already
present, so normal installs and CI are unaffected.

Renovate's lock file maintenance is the only path that deletes the lock
file before regenerating it. Because engines.npm pinned npm to 10.x,
Renovate installed npm 10.9.9 and the regeneration failed, so
frontend/package-lock.json was silently skipped and never received
transitive security updates.

Widening the range lets Renovate pick npm 11, which handles $-refs, while
leaving developers on the npm 10 that node 22 bundles. The upper bound
keeps us on a version we have actually verified.

The lock file records engines, so it is updated to match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@matthewelwell
matthewelwell force-pushed the fix/frontend-npm-overrides branch from 57884a4 to 20935e1 Compare September 14, 2026 11:23
@matthewelwell matthewelwell changed the title fix(frontend): use literal ranges in npm overrides fix(frontend): allow npm 11 so Renovate can refresh the lock file Sep 14, 2026
@github-actions github-actions Bot added fix and removed fix labels Sep 14, 2026
@matthewelwell
matthewelwell merged commit 22bbb04 into main Sep 14, 2026
31 checks passed
@matthewelwell
matthewelwell deleted the fix/frontend-npm-overrides branch September 14, 2026 12:18
@flagsmith-engineering flagsmith-engineering Bot mentioned this pull request Sep 11, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Zaimwa9 Zaimwa9 Zaimwa9 approved these changes
@kyle-ssg kyle-ssg Awaiting requested review from kyle-ssg kyle-ssg is a code owner automatically assigned from Flagsmith/flagsmith-front-end

Assignees

No one assigned

Labels

fix front-end Issue related to the React Front End Dashboard

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@matthewelwell @Zaimwa9