You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
npm: .npmrc files created during artifact updates are never removed #46923
During npm artifact updates, Renovate writes an .npmrc file next to every npm package file, but afterwards it only restores the files that already existed. The files it created stay in the working tree. When the repository uses postUpgradeTasks, the post-upgrade git status finds them, and the default fileFilters (**/*) commits them. In a pnpm or npm workspace, this adds one new .npmrc per workspace package to the PR.
Without postUpgradeTasks, the leftover files are not committed, because only lock files are added to updatedArtifacts. They are still left behind in the working tree for later steps.
Expected behavior
After the artifact update, the working tree contains the same .npmrc files as before it: the existing ones restored, and the created ones deleted.
Proposed fix
Record each .npmrc that did not exist before writing, for example as a separate Set<string>, or with an "absent" marker in originalNpmrcFiles.
Delete those files in restoreNpmrcFiles() with deleteLocalFile().
Add a test in lib/modules/manager/npm/post-update/index.spec.ts covering both cases: an existing .npmrc is restored, and a created .npmrc is deleted.
Activity
Roshan1299 commentedon Oct 13, 2026
Hi @RahulGautamSingh , I'd like to work on this! Can I be assigned?
aqeelat commentedon Oct 13, 2026
Hi @Roshan1299
Sorry i didn't see that you asked for it. I has already started the work. Please review my pr and let me know if you have any comments.