Vulnerability remediation using Yarn resolutions #3093.feat(pnpm): support package.yaml and package.json5 #3653.Feature request: Rushjs monorepo support #3681.latest is not supported as a valid version spec for dependencies in a package.json file #3945.npm: Add support for node compatibility checks #4826.Semver-compatible branch committish incorrectly getting rolled back to tagged versions #5170.Update github hashes in npm package.json files #5640.Improve story for creating PRs to update to nightly builds #5872.Add NPM Audit data to add more detail to Renovate PRs or limit to merge requests to only vulnerability fixes #6027.chore commit type when only the lockfile is updated #6791.Upgrade yarn when version policy is on #7429.Detect if npm package file is nodejs-only #9616.Support npm registries with a general hostRule authentication #9941.Support npmv7 (lock file v2) for transitiveRemediation #10371.Logging installed binary version and constraints mismatch #10382.

Add source URL compare links for npm digest updates #12112.

Handle more complex yarn resolutions #12605.

Option to regenerate lock files during updates #13470.

Support node_modules that live in source control #13926.

PNPM + package from GIT using YARN #18005.

Default npm to use default version from node #19044.

Support rangeStrategy=update-lockfile for pnpm #21438.

npm: support parsing lockfileVersion=3 #21552.

Support updateLockedDependency() for Yarn 2+ #21965.

The below list of features and bugs were current when this page was generated on May 07, 2023.

volta : Renovate will update any node, npm and yarn version specified under volta.

engines : Renovate will update any node, npm and yarn version specified under engines.

The following depTypes are currently supported by the npm manager : Should you Pin your Javascript Dependencies?

Npm updates