From 93b46030b8f32a25883c01d0ac1e13c96a820cba Mon Sep 17 00:00:00 2001 From: Ravi Kiran Papani Date: Wed, 5 Aug 2026 16:21:46 -0700 Subject: [PATCH 1/3] fix(renovate): pin npm <12 for lockfile regeneration The CI runner defaults to npm 12, but @adobe/spacecat-helix-content-sdk pins engines.npm ">=10.9.0 <12.0.0". With engine-strict=true in .npmrc, Renovate's `npm install` to regenerate package-lock.json hard-fails EBADENGINE, so it can only bump package.json -- leaving the lockfile out of sync and every dep-bump PR failing CI's `npm ci` with EUSAGE (e.g. #2453, #2521, #2483). Renovate reads the root engines.npm (">=10.9.0", no ceiling) and so uses npm 12; this constraint overrides that to <12 for lockfile regeneration only. Keeps engine-strict intact and leaves CI's `npm ci` on npm 12 (which works, since npm ci only enforces the root package's engines, not the transitive content-sdk one). Surgical: no change to .npmrc, engines, or the runner. Co-Authored-By: Claude Opus 4.8 --- renovate.json5 | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/renovate.json5 b/renovate.json5 index 16b12ad964..5f09eeb216 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -1,6 +1,15 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "enabled": true, + // Pin the npm Renovate uses to regenerate the lockfile to <12. The CI runner defaults + // to npm 12, but @adobe/spacecat-helix-content-sdk pins engines.npm ">=10.9.0 <12.0.0"; + // with engine-strict=true (.npmrc), an npm-12 `npm install` hard-fails EBADENGINE, so + // Renovate cannot update package-lock.json and every dep-bump PR then fails CI's + // `npm ci` with EUSAGE (package.json vs lock out of sync). Regenerating with npm 11 + // keeps engine-strict intact and leaves CI's `npm ci` on npm 12 (which works). See #2453. + "constraints": { + "npm": "<12.0.0" + }, "extends": [ "local>adobe/spacecat-api-service" ], From f1c1910b57cde869307419f6634f79c18f32d145 Mon Sep 17 00:00:00 2001 From: Ravi Kiran Papani Date: Wed, 5 Aug 2026 16:29:25 -0700 Subject: [PATCH 2/3] chore(renovate): drop inline comment; rationale lives in the PR description Co-Authored-By: Claude Opus 4.8 --- renovate.json5 | 6 ------ 1 file changed, 6 deletions(-) diff --git a/renovate.json5 b/renovate.json5 index 5f09eeb216..81485d2f15 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -1,12 +1,6 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "enabled": true, - // Pin the npm Renovate uses to regenerate the lockfile to <12. The CI runner defaults - // to npm 12, but @adobe/spacecat-helix-content-sdk pins engines.npm ">=10.9.0 <12.0.0"; - // with engine-strict=true (.npmrc), an npm-12 `npm install` hard-fails EBADENGINE, so - // Renovate cannot update package-lock.json and every dep-bump PR then fails CI's - // `npm ci` with EUSAGE (package.json vs lock out of sync). Regenerating with npm 11 - // keeps engine-strict intact and leaves CI's `npm ci` on npm 12 (which works). See #2453. "constraints": { "npm": "<12.0.0" }, From 0a164c1ff2a5c64672b2d2bc5c76c15db487e086 Mon Sep 17 00:00:00 2001 From: Ravi Kiran Papani Date: Wed, 5 Aug 2026 16:44:26 -0700 Subject: [PATCH 3/3] fix(renovate): use full engine range >=10.9.0 <12.0.0 for the npm constraint Mirrors the actual documented requirement of the offending @adobe packages (both a floor and a ceiling), instead of a bare <12.0.0 that could resolve to an unexpectedly old npm. Validated with renovate-config-validator. Co-Authored-By: Claude Opus 4.8 --- renovate.json5 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json5 b/renovate.json5 index 81485d2f15..641a5f4f71 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -2,7 +2,7 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "enabled": true, "constraints": { - "npm": "<12.0.0" + "npm": ">=10.9.0 <12.0.0" }, "extends": [ "local>adobe/spacecat-api-service"