Skip to content

npm: .npmrc files created during artifact updates are never removed #46923

Description

@RahulGautamSingh

Discussed in #46913.

Describe the proposed change(s).

During npm artifact updates, Renovate writes an .npmrc file next to every npm package file, but afterwards it only restores the files that already existed. The files it created stay in the working tree. When the repository uses postUpgradeTasks, the post-upgrade git status finds them, and the default fileFilters (**/*) commits them. In a pnpm or npm workspace, this adds one new .npmrc per workspace package to the PR.

Without postUpgradeTasks, the leftover files are not committed, because only lock files are added to updatedArtifacts. They are still left behind in the working tree for later steps.

Expected behavior

After the artifact update, the working tree contains the same .npmrc files as before it: the existing ones restored, and the created ones deleted.

Proposed fix

  • Record each .npmrc that did not exist before writing, for example as a separate Set<string>, or with an "absent" marker in originalNpmrcFiles.
  • Delete those files in restoreNpmrcFiles() with deleteLocalFile().
  • Add a test in lib/modules/manager/npm/post-update/index.spec.ts covering both cases: an existing .npmrc is restored, and a created .npmrc is deleted.

Activity

  1. Roshan1299 commented on Oct 13, 2026

    @Roshan1299
    Contributor

    Hi @RahulGautamSingh , I'd like to work on this! Can I be assigned?

  2. aqeelat commented on Oct 13, 2026

    @aqeelat

    Hi @Roshan1299

    Sorry i didn't see that you asked for it. I has already started the work. Please review my pr and let me know if you have any comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    manager:npmpackage.json files (npm/yarn/pnpm)

    Type

    Fields

    Priority

    Medium

    Regression introduced in

    None yet

    Datasource

    None yet

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions