Repository navigation
fix(renovate): allow remote tarball fetches during artifact updates - #1346
Merged
Merged
Conversation
npm 12 (Renovate's hosted runner) changed allow-remote's default from all to none. @tailwindcss/oxide's wasm32-wasi optional fallback declares bundleDependencies, which forces npm to download/unpack that tarball to re-resolve the tree on any package.json edit — npm 12 now refuses that as a "remote" fetch even though it comes straight from registry.npmjs.org: npm error code EALLOWREMOTE npm error Fetching packages of type "remote" have been disabled npm error Refusing to fetch ".../@tailwindcss/oxide-wasm32-wasi-4.2.4.tgz" This repo's Renovate npmrc already forces `include=optional` (to keep every platform's optional binaries in the lockfile for devs/CI on other platforms), which is why Renovate touches this package at all. Adding allow-remote=all to that same Renovate-only npmrc unblocks the fetch. Same scoping as #1341's ignoreScripts: it has no effect on real CI or local installs. Seen failing on #1340 (jsdom bump) after #1341 fixed the earlier tsdown/prepare-script issue. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
|
Deploy preview for adp-cost-calculator ready!
Deployed with vercel-action |
Contributor
|
Deploy preview for remote-flows ready!
Deployed with vercel-action |
Contributor
📊 Coverage Report⚪ Coverage unchanged
Detailed BreakdownLines Coverage
Statements Coverage
Functions Coverage
Branches Coverage
✅ Coverage check passed |
jordividaller
approved these changes
Sep 22, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Renovate artifact updates are still failing after #1341, but on a different error. This fixes it.
Changes
allow-remote=allto Renovate's ownnpmrcconfig inrenovate.json.npm 12 (Renovate's hosted runner) changed the
allow-remotedefault fromalltonone.@tailwindcss/oxide'swasm32-wasioptional fallback declaresbundleDependencies, which forces npm to download/unpack that tarball to re-resolve the tree on anypackage.jsonedit. npm 12 now refuses that as a "remote" fetch by default, even though it comes straight fromregistry.npmjs.org:This repo's Renovate
npmrcalready forcesinclude=optional(to keep every platform's optional binaries in the lockfile for devs/CI on other platforms) — that's why Renovate touches this package at all.allow-remote=allis scoped the same way as #1341'signoreScripts: it only affects Renovate's own artifact-update sandbox, not real CI or local installs.Seen failing live on #1340 (jsdom patch bump), which hit this after #1341 already fixed the earlier tsdown/prepare-script issue.
Test plan
renovate.jsonis still valid JSON.renovate/artifactscheck passes and a matchingpackage-lock.jsonis committed.🤖 Generated with Claude Code
Note
Low Risk
Single Renovate-only npmrc tweak with no change to application runtime, auth, or production install behavior.
Overview
Renovate artifact updates were failing with npm 12’s
EALLOWREMOTEwhen re-locking after dependency bumps, because optional packages such as@tailwindcss/oxide’swasm32-wasitarball are treated as remote fetches whileinclude=optionalkeeps them in the tree.This PR adds
allow-remote=allto Renovate’snpmrcinrenovate.json, alongside the existingoptional=true/include=optionalsettings, so Renovate’s lockfile refresh sandbox can download those registry tarballs again. The setting applies only to Renovate’s update runs, not local installs or CI.Reviewed by Cursor Bugbot for commit 3123d22. Bugbot is set up for automated code reviews on this repo. Configure here.