Renovate ignoring npmrc setting in configuration

[verbitan]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.180.0

Please tell us more about your question or problem

Current behavior

Renovate is not respecting the npmrc configuration for the registry when
resolving dependencies, leading to incorrect package resolutions.

Expected behavior

Renovate should ignore the .npmrc file in the repository and use the
configuration provided in the Renovate configuration property npmrc instead.

If configured like this, Renovate will use this to authenticate with npm and
will ignore any .npmrc files(s) it finds checked into the repository.

https://docs.renovatebot.com/getting-started/private-packages/#npm

Minimal reproduction

In https://github.com/verbitan/renovate_issue_npmrc I have:

• Two simple NPM projects.
• An .npmrc file in the root of the repo which overrides the registry with registry=https://registry.npmmirror.com/.
• A minimal .renovate.json which also sets registry=https://registry.npmmirror.com/.

.
├── .npmrc
├── LICENSE
├── README.md
├── example1
│   ├── package-lock.json
│   └── package.json
├── example2
│   ├── package-lock.json
│   └── package.json
└── renovate.json

The merge requests created by Renovate have ignored the npmrc setting and updated the package-lock.json files with https://registry.npmjs.org rather than https://registry.npmmirror.com.

• https://github.com/verbitan/renovate_issue_npmrc/pull/2/changes#diff-83bd88225127c2a2f68ef88b1e3453bbd4488aa3d2d71a728520009caaf52995R552

Logs (if relevant)

Logs

DEBUG: Setting npmrc from decrypted config
DEBUG: Setting npmrc
DEBUG: Resolved shallow config, without merging internal presets
{
  "renovateVersion": "44.180.0",
  "config": {
    "enabledManagers": [
      "npm"
    ],
    "npmrc": "***********"
  },
  "visitedPresets": {
    "merged": [],
    "unmerged": [
      "mergeConfidence:all-badges"
    ]
  }
}

DEBUG: Ignoring any .npmrc files in repository due to configured npmrc
DEBUG: Setting npmrc from resolved config

...

DEBUG: Matched 2 file(s) for manager npm
DEBUG: npm file example1/package.json has name "example1"
INFO: Repo .npmrc file is ignored due to config.npmrc with config.npmrcMerge=false
{
  "npmrcFileName": ".npmrc"
}

DEBUG: npm file example2/package.json has name "example2"
INFO: Repo .npmrc file is ignored due to config.npmrc with config.npmrcMerge=false
{
  "npmrcFileName": ".npmrc"
}

...

DEBUG: packageFiles with updates
{
  "baseBranch": "main",
  "config": {
    "npm": [
      {
        "deps": [
          {
            "depType": "dependencies",
            "depName": "esbuild",
            "currentValue": "0.26.0",
            "datasource": "npm",
            "prettyDepType": "dependency",
            "lockedVersion": "0.26.0",
            "packageName": "esbuild",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "0.28.2",
                "newValue": "0.28.2",
                "hasAttestation": true,
                "releaseTimestamp": "2026-08-08T20:00:55.454Z",
                "newVersionAgeInDays": 76,
                "newMajor": 0,
                "newMinor": 28,
                "newPatch": 2,
                "updateType": "minor",
                "isBreaking": true,
                "libYears": 0.7471167777143582,
                "branchName": "renovate/esbuild-0.x"
              }
            ],
            "versioning": "npm",
            "warnings": [],
            "sourceUrl": "https://github.com/evanw/esbuild",
            "registryUrl": "https://registry.npmmirror.com",
            "mostRecentTimestamp": "2026-08-08T20:00:55.454Z",
            "currentVersion": "0.26.0",
            "currentVersionTimestamp": "2025-11-09T03:16:20.752Z",
            "currentVersionAgeInDays": 349,
            "isSingleVersion": true,
            "fixedVersion": "0.26.0"
          },
          {
            "depType": "devDependencies",
            "depName": "eslint",
            "currentValue": "10.0.0",
            "datasource": "npm",
            "prettyDepType": "devDependency",
            "lockedVersion": "10.0.0",
            "packageName": "eslint",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "10.13.0",
                "newValue": "10.13.0",
                "hasAttestation": false,
                "downloadUrl": "https://registry.npmmirror.com/eslint/-/eslint-10.13.0.tgz",
                "newDigest": "sha512-UohDjD4zSzEwhf58M3O7vc/ycc8O1I7dNlhtD0WxE8Px8EHNJKtUwzBqrzeGhisRuv2ag4sAYswszCJRgKXYUg==",
                "releaseTimestamp": "2026-10-16T14:24:10.765Z",
                "newVersionAgeInDays": 7,
                "newMajor": 10,
                "newMinor": 13,
                "newPatch": 0,
                "updateType": "minor",
                "isBreaking": false,
                "libYears": 0.6894851231925418,
                "branchName": "renovate/eslint-10.x"
              }
            ],
            "versioning": "npm",
            "warnings": [],
            "sourceUrl": "https://github.com/eslint/eslint",
            "registryUrl": "https://registry.npmmirror.com",
            "homepage": "https://eslint.org",
            "mostRecentTimestamp": "2026-10-16T14:24:10.765Z",
            "currentVersion": "10.0.0",
            "currentVersionTimestamp": "2026-02-06T22:30:47.920Z",
            "currentVersionAgeInDays": 259,
            "isSingleVersion": true,
            "fixedVersion": "10.0.0"
          }
        ],
        "extractedConstraints": {
          "npm": ">=7"
        },
        "packageFileVersion": "1.0.0",
        "managerData": {
          "packageJsonName": "example1",
          "hasPackageManager": false,
          "npmLock": "example1/package-lock.json",
          "yarnZeroInstall": false,
          "npmrcFileName": ".npmrc"
        },
        "npmrc": "***********",
        "skipInstalls": true,
        "packageFile": "example1/package.json",
        "lockFiles": [
          "example1/package-lock.json"
        ]
      },
      {
        "deps": [
          {
            "depType": "dependencies",
            "depName": "esbuild",
            "currentValue": "0.26.0",
            "datasource": "npm",
            "prettyDepType": "dependency",
            "lockedVersion": "0.26.0",
            "packageName": "esbuild",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "0.28.2",
                "newValue": "0.28.2",
                "hasAttestation": true,
                "releaseTimestamp": "2026-08-08T20:00:55.454Z",
                "newVersionAgeInDays": 76,
                "newMajor": 0,
                "newMinor": 28,
                "newPatch": 2,
                "updateType": "minor",
                "isBreaking": true,
                "libYears": 0.7471167777143582,
                "branchName": "renovate/esbuild-0.x"
              }
            ],
            "versioning": "npm",
            "warnings": [],
            "sourceUrl": "https://github.com/evanw/esbuild",
            "registryUrl": "https://registry.npmmirror.com",
            "mostRecentTimestamp": "2026-08-08T20:00:55.454Z",
            "currentVersion": "0.26.0",
            "currentVersionTimestamp": "2025-11-09T03:16:20.752Z",
            "currentVersionAgeInDays": 349,
            "isSingleVersion": true,
            "fixedVersion": "0.26.0"
          },
          {
            "depType": "devDependencies",
            "depName": "eslint",
            "currentValue": "10.0.0",
            "datasource": "npm",
            "prettyDepType": "devDependency",
            "lockedVersion": "10.0.0",
            "packageName": "eslint",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "10.13.0",
                "newValue": "10.13.0",
                "hasAttestation": false,
                "downloadUrl": "https://registry.npmmirror.com/eslint/-/eslint-10.13.0.tgz",
                "newDigest": "sha512-UohDjD4zSzEwhf58M3O7vc/ycc8O1I7dNlhtD0WxE8Px8EHNJKtUwzBqrzeGhisRuv2ag4sAYswszCJRgKXYUg==",
                "releaseTimestamp": "2026-10-16T14:24:10.765Z",
                "newVersionAgeInDays": 7,
                "newMajor": 10,
                "newMinor": 13,
                "newPatch": 0,
                "updateType": "minor",
                "isBreaking": false,
                "libYears": 0.6894851231925418,
                "branchName": "renovate/eslint-10.x"
              }
            ],
            "versioning": "npm",
            "warnings": [],
            "sourceUrl": "https://github.com/eslint/eslint",
            "registryUrl": "https://registry.npmmirror.com",
            "homepage": "https://eslint.org",
            "mostRecentTimestamp": "2026-10-16T14:24:10.765Z",
            "currentVersion": "10.0.0",
            "currentVersionTimestamp": "2026-02-06T22:30:47.920Z",
            "currentVersionAgeInDays": 259,
            "isSingleVersion": true,
            "fixedVersion": "10.0.0"
          }
        ],
        "extractedConstraints": {
          "npm": ">=7"
        },
        "packageFileVersion": "1.0.0",
        "managerData": {
          "packageJsonName": "example2",
          "hasPackageManager": false,
          "npmLock": "example2/package-lock.json",
          "yarnZeroInstall": false,
          "npmrcFileName": ".npmrc"
        },
        "npmrc": "***********",
        "skipInstalls": true,
        "packageFile": "example2/package.json",
        "lockFiles": [
          "example2/package-lock.json"
        ]
      }
    ]
  }
}

...

DEBUG: Branch needs creating (branch="renovate/eslint-10.x")
DEBUG: Using reuseExistingBranch: false (branch="renovate/eslint-10.x")
DEBUG: Setting current branch to main (branch="renovate/eslint-10.x")
DEBUG: latest commit (branch="renovate/eslint-10.x")
{
  "branchName": "main",
  "latestCommitDate": "2026-10-24T10:09:48.000Z",
  "sha": "5961f8466e286a4e6d8adb896896e8e142a5f52f"
}

DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (branch="renovate/eslint-10.x")
DEBUG: npm.updateDependency(): devDependencies.eslint = 10.13.0 (branch="renovate/eslint-10.x")
DEBUG: Updating eslint in example2/package.json (branch="renovate/eslint-10.x")
DEBUG: npm.updateDependency(): devDependencies.eslint = 10.13.0 (branch="renovate/eslint-10.x")
DEBUG: Updating eslint in example1/package.json (branch="renovate/eslint-10.x")
DEBUG: updateArtifacts for updatedPackageFiles (branch="renovate/eslint-10.x")
DEBUG: npm.updateArtifacts(example1/package.json) (branch="renovate/eslint-10.x")
DEBUG: npm.updateArtifacts(example2/package.json) (branch="renovate/eslint-10.x")
DEBUG: Updated 2 package files (branch="renovate/eslint-10.x")
DEBUG: Getting updated lock files (branch="renovate/eslint-10.x")
DEBUG: Writing package.json files (branch="renovate/eslint-10.x")
{
  "packageFiles": [
    "example1/package.json",
    "example2/package.json"
  ]
}

DEBUG: Writing example1/package-lock.json (branch="renovate/eslint-10.x")
DEBUG: Massaging npm lock file before writing to disk (branch="renovate/eslint-10.x")
DEBUG: Writing example2/package-lock.json (branch="renovate/eslint-10.x")
DEBUG: Massaging npm lock file before writing to disk (branch="renovate/eslint-10.x")
DEBUG: Writing any updated package files (branch="renovate/eslint-10.x")
DEBUG: Writing example2/package.json (branch="renovate/eslint-10.x")
DEBUG: Writing example1/package.json (branch="renovate/eslint-10.x")
DEBUG: Found 0 npm host rule(s) (branch="renovate/eslint-10.x")
DEBUG: Found 0 host rule(s) without host type (branch="renovate/eslint-10.x")
DEBUG: Found 0 host rule(s) without host type after dropping duplicates (branch="renovate/eslint-10.x")
DEBUG: Generating package-lock.json for example2 (branch="renovate/eslint-10.x")
DEBUG: Spawning npm install to create example2/package-lock.json (branch="renovate/eslint-10.x")
DEBUG: Updating lock file only (branch="renovate/eslint-10.x")
DEBUG: No node constraint found - using latest (branch="renovate/eslint-10.x")
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /runner/cache/containerbase (branch="renovate/eslint-10.x")
DEBUG: Using containerbase dynamic installs (branch="renovate/eslint-10.x")
DEBUG: Resolved stable matching version (branch="renovate/eslint-10.x")
{
  "toolName": "node",
  "constraint": null,
  "resolvedVersion": "24.22.1"
}

DEBUG: Filtered out 1 non-matching releases out of 611 total for npm due to constraintsFiltering=strict: 1.1.25 (branch="renovate/eslint-10.x")
{
  "datasource": "npm",
  "packageName": "npm"
}

DEBUG: Resolved stable matching version (branch="renovate/eslint-10.x")
{
  "toolName": "npm",
  "constraint": ">=7",
  "resolvedVersion": "12.2.1"
}

DEBUG: Executing command (branch="renovate/eslint-10.x")
{
  "command": "npm install --package-lock-only --no-audit --ignore-scripts",
  "env": [
    "NPM_CONFIG_CACHE",
    "npm_config_store",
    "HOME",
    "PATH",
    "LC_ALL",
    "LANG",
    "CI",
    "CONTAINERBASE_CACHE_DIR"
  ]
}

DEBUG: exec completed (branch="renovate/eslint-10.x")
{
  "durationMs": 1052,
  "stdout": "\nup to date in 664ms\n",
  "stderr": "npm warn Unknown env config \"store\". This will error in a future major version of npm. See `npm help npmrc` for supported config options.\n"
}

DEBUG: example2/package-lock.json needs updating (branch="renovate/eslint-10.x")
DEBUG: Generating package-lock.json for example1 (branch="renovate/eslint-10.x")
DEBUG: Spawning npm install to create example1/package-lock.json (branch="renovate/eslint-10.x")
DEBUG: Updating lock file only (branch="renovate/eslint-10.x")
DEBUG: No node constraint found - using latest (branch="renovate/eslint-10.x")
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /runner/cache/containerbase (branch="renovate/eslint-10.x")
DEBUG: Using containerbase dynamic installs (branch="renovate/eslint-10.x")
DEBUG: Resolved stable matching version (branch="renovate/eslint-10.x")
{
  "toolName": "node",
  "constraint": null,
  "resolvedVersion": "24.22.1"
}

DEBUG: Filtered out 1 non-matching releases out of 611 total for npm due to constraintsFiltering=strict: 1.1.25 (branch="renovate/eslint-10.x")
{
  "datasource": "npm",
  "packageName": "npm"
}

DEBUG: Resolved stable matching version (branch="renovate/eslint-10.x")
{
  "toolName": "npm",
  "constraint": ">=7",
  "resolvedVersion": "12.2.1"
}

DEBUG: Executing command (branch="renovate/eslint-10.x")
{
  "command": "npm install --package-lock-only --no-audit --ignore-scripts",
  "env": [
    "NPM_CONFIG_CACHE",
    "npm_config_store",
    "HOME",
    "PATH",
    "LC_ALL",
    "LANG",
    "CI",
    "CONTAINERBASE_CACHE_DIR"
  ]
}

DEBUG: exec completed (branch="renovate/eslint-10.x")
{
  "durationMs": 717,
  "stdout": "\nup to date in 336ms\n",
  "stderr": "npm warn Unknown env config \"store\". This will error in a future major version of npm. See `npm help npmrc` for supported config options.\n"
}

DEBUG: example1/package-lock.json needs updating (branch="renovate/eslint-10.x")
DEBUG: Updated 2 lock files (branch="renovate/eslint-10.x")
{
  "updatedArtifacts": [
    "example2/package-lock.json",
    "example1/package-lock.json"
  ]
}

DEBUG: 4 file(s) to commit (branch="renovate/eslint-10.x")
DEBUG: Preparing files for committing to branch renovate/eslint-10.x (branch="renovate/eslint-10.x")
DEBUG: git commit (branch="renovate/eslint-10.x")
{
  "deletedFiles": [],
  "ignoredFiles": [],
  "result": {
    "author": null,
    "branch": "renovate/eslint-10.x",
    "commit": "f64e02704ebec89d469f48a94d84abb32b4edf59",
    "root": false,
    "summary": {
      "changes": 4,
      "insertions": 284,
      "deletions": 0
    }
  }
}

DEBUG: resetToCommit(5961f8466e286a4e6d8adb896896e8e142a5f52f) (branch="renovate/eslint-10.x")
DEBUG: Fetching branch renovate/eslint-10.x (branch="renovate/eslint-10.x")
DEBUG: Setting current branch to main (branch="renovate/eslint-10.x")
DEBUG: latest commit (branch="renovate/eslint-10.x")
{
  "branchName": "main",
  "latestCommitDate": "2026-10-24T10:09:48.000Z",
  "sha": "5961f8466e286a4e6d8adb896896e8e142a5f52f"
}

INFO: Branch created (branch="renovate/eslint-10.x")
{
  "commitSha": "35a3d44baedc6a4d1cabb11260abdf500ad1f046"
}

DEBUG: Ensuring PR (branch="renovate/eslint-10.x")
DEBUG: There are 0 errors and 0 warnings (branch="renovate/eslint-10.x")
DEBUG: getBranchPr(renovate/eslint-10.x) (branch="renovate/eslint-10.x")
DEBUG: findPr(renovate/eslint-10.x, undefined, open) (branch="renovate/eslint-10.x")
DEBUG: findPr(renovate/eslint-10.x, undefined, closed) (branch="renovate/eslint-10.x")
DEBUG: Fetching changelog: https://github.com/eslint/eslint (10.0.0 -> 10.13.0) (branch="renovate/eslint-10.x")
DEBUG: Fetching changelog: https://github.com/eslint/eslint (10.0.0 -> 10.13.0) (branch="renovate/eslint-10.x")
DEBUG: Already fetched enough changelogs to hit the platform PR body limit, skipping version 10.4.1 and below (branch="renovate/eslint-10.x")
{
  "project": {
    "apiBaseUrl": "https://api.github.com/",
    "baseUrl": "https://github.com/",
    "type": "github",
    "repository": "eslint/eslint",
    "sourceUrl": "https://github.com/eslint/eslint",
    "packageName": "eslint",
    "depName": "eslint"
  },
  "skippingVersionFrom": "10.4.1",
  "maxBodyLength": 58000
}

DEBUG: Already fetched enough changelogs to hit the platform PR body limit, skipping version 10.4.1 and below (branch="renovate/eslint-10.x")
{
  "project": {
    "apiBaseUrl": "https://api.github.com/",
    "baseUrl": "https://github.com/",
    "type": "github",
    "repository": "eslint/eslint",
    "sourceUrl": "https://github.com/eslint/eslint",
    "packageName": "eslint",
    "depName": "eslint"
  },
  "skippingVersionFrom": "10.4.1",
  "maxBodyLength": 58000
}

DEBUG: Truncating PR body due to platform limitation of 58000 characters (branch="renovate/eslint-10.x")
DEBUG: Creating PR (branch="renovate/eslint-10.x")
{
  "prTitle": "Update dependency eslint to v10.13.0"
}

DEBUG: prHourlyLimit of the upgrades present in this branch (branch="renovate/eslint-10.x")
{
  "limits": [
    {
      "depName": "eslint",
      "prHourlyLimit": 2
    }
  ]
}

DEBUG: Calculated lowest prHourlyLimit among the upgrades present in this branch is 2. (branch="renovate/eslint-10.x")
DEBUG: prConcurrentLimit of the upgrades present in this branch (branch="renovate/eslint-10.x")
{
  "limits": [
    {
      "depName": "eslint",
      "prConcurrentLimit": 10
    }
  ]
}

DEBUG: Calculated lowest prConcurrentLimit among the upgrades present in this branch is 10. (branch="renovate/eslint-10.x")
DEBUG: Creating PR (branch="renovate/eslint-10.x")
{
  "title": "Update dependency eslint to v10.13.0",
  "head": "verbitan:renovate/eslint-10.x",
  "base": "main",
  "draft": false
}

DEBUG: PR created (branch="renovate/eslint-10.x")
{
  "pr": 2,
  "draft": false
}

DEBUG: Adding labels '' to #2 (branch="renovate/eslint-10.x")
INFO: PR created (branch="renovate/eslint-10.x")
{
  "pr": 2,
  "prTitle": "Update dependency eslint to v10.13.0",
  "labels": []
}

[mrx-arafat]

Copy the root .npmrc into both example1/ and example2/, commit those files, then request a rebase of the Renovate PR:

cp .npmrc example1/.npmrc
cp .npmrc example2/.npmrc

The metadata lookup is using your mirror. The problem is the lockfile step: Renovate 44.180.0 finds the root .npmrc but skips writing the configured npmrc beside either nested package.json. npm runs inside those separate projects and doesn't read the parent's project .npmrc, so it falls back to npmjs. Putting the file in each project also lets Renovate apply your configured npmrc there.

[verbitan]

That works as a workaround, but I have a repo with hundreds of npm projects inside, and I want to override all of them with the Renovate configured npmrc. Is that not how the npmrc Renovate setting is indented to work?

[mrx-arafat]

It works that way when the repo has no .npmrc for those projects. Renovate only writes your configured npmrc next to a package.json when it found no .npmrc for that project, or found one in that same folder. With your layout every project resolves to the root file, so the write gets skipped and npm in each subfolder falls back to npmjs.

So for hundreds of projects the simpler route is to drop or rename the root .npmrc (if you only need it for local installs, a user-level ~/.npmrc works for that). Then each project has no .npmrc of its own and Renovate writes the configured one beside every package.json during lockfile updates. Whether skipping it with a parent .npmrc is intended is a question for the maintainers, but that's what 44.180.0 does today.