How to let Renovate run npm install --force by default if there is a dependency issue for npm 7?

[hongbo-miao]

I am using npm 7, when I am using Renovate, sometimes I met issues like this

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻️ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you check the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: web/package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! Found: react@17.0.2
npm ERR! node_modules/react
npm ERR!   react@"17.0.2" from the root project
npm ERR!   peer react@"15.x || 16.x || 17.x" from @sentry/react@6.2.5
npm ERR!   node_modules/@sentry/react
npm ERR!     @sentry/react@"6.2.5" from the root project
npm ERR!   23 more (@testing-library/react, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@"15.x || 16.x || 16.4.0-alpha.0911da3" from @reach/router@1.3.4
npm ERR! node_modules/@storybook/api/node_modules/@reach/router
npm ERR!   @reach/router@"^1.3.4" from @storybook/api@6.2.2
npm ERR!   node_modules/@storybook/api
npm ERR!     @storybook/api@"6.2.2" from @storybook/addon-actions@6.2.2
npm ERR!     node_modules/@storybook/addon-actions
npm ERR!       dev @storybook/addon-actions@"6.2.2" from the root project
npm ERR!     1 more (@storybook/addons)
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate-cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2021-04-02T12_33_08_652Z-debug.log

What I do is usually run npm install --force locally and push again.
(I am aware this is a peer dependency issue, but usually it won't cause problems, so the risk is acceptable for some projects. For difference between --force and --legacy-peer-deps, please check here)

My question is: is there an option let Renovate run npm install --force by default if there is a dependency issue? Thanks!

[rarkins]

Only if you can add it to your .npmrc

[hongbo-miao]

Just confirmed, adding force=true in .npmrc works. Thanks, Rhys!

[hongbo-miao]

Hi @rarkins I notice if I add force=true in .npmrc, it will add --force to all scripts such npm start, npm test, npm run dev and gives warnings. So this is not ideal solution.

I think as more people start to use npm 7 (shipped with Node.js 15 and future 16), more people will have same question when use Renovate.

I don't have a perfect solution in my mind. Just wonder should “passing --force or something else when install” be a feature on Renovate side?

[rarkins]

We may end up supporting that, but isn't the root cause that you are using npm@7's new peer dependencies on a repository which isn't well suited to it?

Similarly, why not use legacy peer deps handling instead of force? I understand there's a difference, but do not understand why it's important to you.

[hongbo-miao]

I just tried to set legacy-peer-deps=true in my .npmrc. It seems solving the upgrading issue, and also won't affect npm start, npm test, etc.

Maybe this is the solution before npm decides to remove --legacy-peer-deps at some point in future (just guessed based its name).

---

Oh I guess --legacy-peer-deps will be removed at some point based its name. I agree it is a peer dependency issue. The ideal solution is each npm package author needs to update on their sides.

However, before when I use yarn 1, the packages can just upgrading without any issues including manually and Renovate, as long as no breaking changes. So I rarely interact with it (maybe just one time a month to fix breaking changes caught by my tests).

With same dependencies, after I switched to npm 7, I got “Renovate fails to upgrade” issue every several days, and I have to pull the branch, run npm install --force locally, and push again, which is quite annoyed. And I would say maybe 95% time, it never has any issue by upgrading even has peer dependency issue. Even that 5% time, it will be caught by my tests.

---

I am doing one more experiment currently and will report back.

Before I was using Node.js 14 with npm 7 (by setting package-lock.json to version 2).
I have upgraded to Node.js 15 which ships with npm 7 by default. I have removed force=true in .npmrc and see if I still get Renovate fails to upgrade issue again.

[rarkins]

We usually try to work around or overcome problems in other managers, if no other alternative exists.

Let's consider the two main use cases here:

1. Your base branch fails due to peer deps unless you set legacy peer dep handling in npm. In this case you have a problem regardless of whether you use Renovate or not. Best to just configure legacy peer deps in .npmrc and remove Renovate errors too.
2. Your base branch passes npm@7 default peer dep handling, but sometimes Renovate's update PRs fail it. Wouldn't you prefer to know that, rather than suppress it?