Renovate fails to update examples/nextjs EALLOWREMOTE

Situation

Renovate PR chore(deps): update dependency cypress to v16.1.0 #1900 in branch https://github.com/cypress-io/github-action/tree/renovate/cypress-16.x is failing to update examples/nextjs.

Renovate reports:

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-16T17_13_40_949Z-debug-0.log

and Cursor reports that examples/nextjs/package.json is out of sync with examples/nextjs/package-lock.json

Assessment

Renovate is currently rolling out new versions and this seems to have introduced an incompatibility.

The error message indicates that Renovate is using npm@12 which is not configured (or blocked) in this repo. Node.js 22 packages npm 11; Node.js 24 & 26 package npm 11.

Restricting the examples/nextjs package to use only npm 11 & 12 through an engines entry works around the issue.

Suggestion

Update the repo manually to Cypress 16.1.0 (using npm run update:cypress which completes without error). Given that there is already a backlog of unreviewed PRs, creating yet another one should be delayed.

Hold back the workaround of using an engines entry. It may be that Renovate acknowledges this separately as an issue and fixes it.

The Renovate issue is reproducible without using Renovate, however in order to understand what Renovate is doing I needed to run it privately so that I had access to the logs. Renovate only allows access to users with write access to the repo, and I do not belong to this group.

To reproduce, on Ubuntu 24.04.5 LTS, Node.js 24.21.0 LTS

git clone https://github.com/cypress-io/github-action
cd github-action
cd examples/nextjs
npm install npm@12 -g
npm install --package-lock-only --no-audit --ignore-scripts

To resolve

echo "allow-remote=all" > .npmrc

and repeat.

#1904 (review) notes:

For reference, the upstream npm bug is npm/cli#9800, with fixes in progress in npm/cli#9819 and npm/cli#9921. Once one of those ships, the .npmrc can go.

[BUG] --dry-run fails with EALLOWREMOTE on registry tarballs for packages that declare bundleDependencies npm/cli#9800 is linked to
fix(arborist): allow registry bundle inspection in dry runs npm/cli#9818

The other PRs are:

test(deps): add allow-remote=all to nextjs example #1904 implemented a workaround

Leaving this issue open, to track when npm@12 is fixed, which would allow the workaround to be removed.

Moved to #1911 for clarity of follow-up.

Navigation Menu

Repository navigation

Renovate fails to update examples/nextjs EALLOWREMOTE #1901

Situation

Assessment

Suggestion

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Renovate fails to update examples/nextjs EALLOWREMOTE #1901

Description

Situation

Assessment

Suggestion

Activity

MikeMcC399 commented on Sep 17, 2026

MikeMcC399 commented on Sep 18, 2026

MikeMcC399 commented on Sep 18, 2026

MikeMcC399 commented on Sep 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions