Set npm/yarn/pnpm version

Description:
Similar to how we can set the node version I'd like to set the npm version.

node-version: 1.16.x
npm-version: 8.5.5

There is a similar issue here #213, but it's for a different reason and this one can be resolved by setting the node version. However this is not enough for the problems I have been facing.

Justification:
Currently I am struggling with a bug in npm from versions 8.11 to 8.13. These are automatically installed when you chose node version 1.16. This means I have to set back my npm version so the ci can run, which I can do in an extra ci step.

However to me the issue is that the npm version will change over time, without our input. We'd like control over this to prevent issues like the one above from showing up.

Are you willing to submit a PR?
Not currently but I might in the future.

Hi @stijn-gravity, thank you for your proposal, we will consider it.

I will be opening a PR on this!

Two options for specifying a solution could be querying the volta section of the package.json if you manage versions via that, or via the engines portion of the package.json https://docs.npmjs.com/cli/v8/configuring-npm/package-json#engines

You can "set" npm/yarn/pnpm version if you use corepack:

corepack npm@a.b.c install
corepack yarn@a.b.c install
corepack pnpm@a.b.c install

Or manually install package managers:

npm install npm@a.b.c
yarn set version a.b.c
npm install pnpm@a.b.c # Or use pnpm/action-setup which has a version option

This should be solved by #531

Also see #546

Explicitly use npm@11.7.0 when upgrading dependencies

Explicitly use npm@11.7.0 in workflows

Explicitly use npm@11.7.0 in workflows (#8036)

ci: Enforce a minimum npm release age for increased supply chain secu…

Additionally to explicitly setting an NPM version it would be good if this action supported engines.npm in packages.json (https://docs.npmjs.com/cli/v11/configuring-npm/package-json#engines) so that it installs the right npm version from this.

Otherwise users need to do somewhat ugly workarounds like the one here: christian-heusel/notebooks@790e0e1

This in turn is needed because only newer versions of npm support min-release-age which is atleast some help with regard to a lot of the currently ongoing supply chain attacks.

ci: Enforce a minimum npm release age for increased supply chain secu…

ci: set min age for `npm` installed packages (#1003)

Install specific npm version on GitHub Actions

@christian-heusel

Additionally to explicitly setting an NPM version it would be good if this action supported engines.npm in packages.json (https://docs.npmjs.com/cli/v11/configuring-npm/package-json#engines) so that it installs the right npm version from this.

@christian-heusel The action already supports devEngines.packageManager OR packageManager to determine the package manager for caching.
Implementation: https://github.com/actions/setup-node/blob/v7.0.0/src/main.ts#L154-L167

Using devEngines.packageManager.version could possibly take care of this.

See package.json's devEngines https://docs.npmjs.com/cli/v12/configuring-npm/package-json#devengines

Navigation Menu

Repository navigation

Set npm/yarn/pnpm version #529

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Set npm/yarn/pnpm version #529

Description

Activity

vsafonkin commented on Jun 27, 2022

brillaintlcd commented on Jul 30, 2022

jasikpark commented on Aug 2, 2022

kidonng commented on Sep 14, 2022

nickserv commented on Sep 24, 2022

styfle commented on Sep 28, 2022

christian-heusel commented on Apr 2, 2026

risantos commented on Aug 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions