Azure DevOps Npm Package Feed & Update detection

[japj]

Hello,

I am using an Azure DevOps Server 2020 NPM Package Feed that is connected to upstream npmjs.org.

From what I understand (of the package feed “design”) is that it will only list the packages that are actually cached in the package feed. And the only way to get newer versions in it is by explicitly asking it for a specific version (e.g. by manually installing), which will cause it to fetch that version from the upstream npmjs.

The issue I am seeing with this is that renovate (which is configured to only connect with the azure DevOps server npm package feed) will not detect that certain newer package versions are available upstream, until someone manually requests for it first.

Is there way to configure/setup renovate so it will also look for newer versions on additional (upstream) npm feeds, but only generate package lock files that show the azure DevOps server package feed urls?

[rarkins]

You could try this:

"packageRules": [{
  "matchDatasources": ["npm"],
  "npmrc": "registry=https://registry.npmjs.org"
}, {
  "matchDatasources": ["npm"],
  "matchUpdateTypes": ["pin", "patch", "minor", "major"],
  "npmrc": null
}]

The idea is that the first rule overrides your npmrc to use the main registry, and the second one resets it. If null doesn't work then you could try copying your original npmrc instead (the one that points to your private registry).