From 20935e137b12f15634e301f538352d1729e4719d Mon Sep 17 00:00:00 2001 From: Matthew Elwell Date: Mon, 14 Sep 2026 12:23:37 +0100 Subject: [PATCH] fix(frontend): allow npm 11 so Renovate can refresh the lock file npm 10 cannot resolve $-prefixed override references when building a lock file from scratch, failing with "Unable to resolve reference $". It resolves them correctly whenever a lock file is already present, so normal installs and CI are unaffected. Renovate's lock file maintenance is the only path that deletes the lock file before regenerating it. Because engines.npm pinned npm to 10.x, Renovate installed npm 10.9.9 and the regeneration failed, so frontend/package-lock.json was silently skipped and never received transitive security updates. Widening the range lets Renovate pick npm 11, which handles $-refs, while leaving developers on the npm 10 that node 22 bundles. The upper bound keeps us on a version we have actually verified. The lock file records engines, so it is updated to match. Co-Authored-By: Claude Opus 5 --- frontend/package-lock.json | 2 +- frontend/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 9c7455165242..fbcd11a7f705 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -148,7 +148,7 @@ }, "engines": { "node": "22.x", - "npm": "10.x" + "npm": ">=10 <12" }, "optionalDependencies": { "webpack": "^5.105.4" diff --git a/frontend/package.json b/frontend/package.json index 80a77c4b20a5..ab3fae09aa0b 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -38,7 +38,7 @@ }, "engines": { "node": "22.x", - "npm": "10.x" + "npm": ">=10 <12" }, "overrides": { "react": "$react",