Renovate only updates my package.json — the package-lock.json is always left unchanged in the same PR.

[Arthur-Lucas]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

I'm using renovate on Gitlab, and v39.259.0 for Renovate

Please tell us more about your question or problem

Hello everyone,
I'm trying to create an npm manager preset for my Renovate bot. My code is actually working — the PRs are successfully created with the correct config — but when I look at the changes, the PR only edits the package.json and seems to ignore the package-lock.json.

What I want is for Renovate to update the package-lock.json in the same PR whenever a package is updated.

I’ve tried several solutions such as:

• updateLockFiles
• rangeStrategy
• postUpgradeTasks

But none of them worked.

Here’s the minimal reproduction of my dev :

https://github.com/Arthur-Lucas/renovate-lockfile-issue

Logs (if relevant)

no relevant logs

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[Arthur-Lucas]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

I'm using renovate on Gitlab, and v39.259.0 for Renovate

Please tell us more about your question or problem

Hello everyone, I'm trying to create an npm manager preset for my Renovate bot. My code is actually working — the PRs are successfully created with the correct config — but when I look at the changes, the PR only edits the package.json and seems to ignore the package-lock.json.

What I want is for Renovate to update the package-lock.json in the same PR whenever a package is updated.

I’ve tried several solutions such as:

• updateLockFiles
• rangeStrategy
• postUpgradeTasks

But none of them worked.

Here’s the minimal reproduction of my dev :

https://github.com/Arthur-Lucas/renovate-lockfile-issue

Logs (if relevant)

no relevant logs

Minimal reproduction added

[rarkins]

Please minimize the reproduction - no config.js, no extends.

And install the hosted bot to verify the reproduction

[Arthur-Lucas]

I've fixed the reproduction.
My self-hosted app is running on GitLab repositories. Does that change anything?

[github-actions[bot]]

Hi there,

We appreciate the effort you put into creating a reproduction. But your reproduction is not minimal yet, or is missing fields we ask for in our template.

Please re-read the steps and documentation given in the previous message, and try again to create a minimal reproduction.

Thanks, the Renovate team

[Arthur-Lucas]

I solved it ! I had to add a RENOVATE_GITHUB_COM_TOKEN variable to my GitLab project and check the retry boxes on every PR.
like this :

But I still have an issue with my private packages (hosted privately on GitLab). I have already set up hostRules and packageRules to handle authentication for the package. I can currently access the package to check the version, and my package.json is updated, but my package-lock.json is never updated.

[rubiesonthesky]

The package-lock problem seems to be similar as in #34017 - this used to work but some update broke it.

[Arthur-Lucas]

My problem with the private package only happens during the update of my package-lock.json. Renovate points to https://registry.npmjs.org instead of the registry URL I set in the package rules.

"packageRules": [
    {
      "matchDatasources": ["npm"],
      "matchPackageNames": [
        "@my/package",
      ],
      "registryUrls": [
        "https://my.gitlab.com/api/v4/packages/npm/"
      ],
      "groupName": "Private Packages"
    }
]

This packageRules works because it updates my package.json

Here are some logs: :

[Arthur-Lucas]