Renovate only updating package-lock.json but not package.json itself

[pieterjandebruyne]

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

azure devops @ v37.334.3

Please tell us more about your question or problem

We added renovate to a turbo monorepo (https://turbo.build/) the onboarding PR detected the different package.json files in the subprojects as expected. Now that is generating PRS the issue is it only includes the package-lock.json changes but not the actual version bump in package.json.
I read in the docs that renovate does not update lock files directly but rather updates the package.json file and then runs npm i.

Renovate updates the dependencies of the sub projects in the package-lock.json but no package.json change is pushed in the PR.
Example changes in one of the renovate PRS (package-lock.json):

We would expect the change in dependency "@tanstack/react-virtual": "^3.5.0", to also be reflected in the package.json.
If I run npm i myself on the PR branch it would reset the version of the dependency defined in lock file (first diff change in screenshot) to the 3.0.0 version (but the second part of changes would be kept, it would still install 3.5.0 as expected.)

Why it is not updating my package.json file in these PRs?
I did notice the --package-lock-only flag in the npm i command + all PR branches have a -lockfile suffix. Can I enable the generation of package.json file with a config or should this normally be done automatically?

Renovate v37.334.3
"engines": {
"node": "20.10.0",
"npm": ">=10.2.0"
}

Logs (if relevant)

"command": "npm install --package-lock-only --no-audit --ignore-scripts --workspace=apps/client @tanstack/react-virtual@3.5.0"

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

Read the Renovate docs, troubleshooting, self-hosted to learn how to find the logs.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[rarkins]

Read the docs for rangeStrategy

[pieterjandebruyne]

@rarkins thanks for the quick response,
I added this to the renovate.json file that was created on onboarding:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "rangeStrategy": "bump"
}

*** deprecated comment (see next) ***
But this still is generating PRs without package.json changes. also the branches it creates still are of format renovate/packageX-2.x-lockfile

[pieterjandebruyne]

Ok, adding the debug logs again gave an error on invalid json for the config (had a trailing comma in the config I posted before, I updated the config above for future people that might copy paste it in.
Everything is working as expected now 👍