force.constraints will override any constraints detected by package managers

[yoavain]

What Renovate type, platform and version are you using?
hosted, GitHub

Describe the bug
Renovate do not honor node constraints and updates lock file to version 2

Relevant debug logs

Have you created a minimal reproduction repository?
No, But here's the PR:
https://github.com/yoavain/webpack-playground/pull/324/files

Please read the minimal reproductions documentation to learn how to make a good minimal reproduction repository.

• This is a really small bug, it does not need a reproduction (think small typo)
• I have provided a minimal reproduction repository
• I don't have time for that, but it happens in a public repository I have linked to
• I don't have time for that, and cannot share my private repository
• The nature of this bug means it's impossible to reproduce publicly

Additional context

My renovate.json contains the following:

    "force": {
        "constraints": {
            "node": "< 15.0.0"
        }
    },

[viceice]

Please add npm constraint too, as v7 is now tagged as latest.

We already fixed the lockfile version detection in renovate, but it's probably not yet published to the hosted app.

[rarkins]

It is - the problem is that this config forces the constraints to have no npm version. Completely removing the force object is recommended.

[rarkins]

Your force config is overriding the constraints which are detected in the package.json. In other words, it's your config making it not work.

If you remove it, it works as expected: https://github.com/renovate-tests/webpack-playground/pull/1/files

[yoavain]

Thanks!
I now got another PR suggesting to update npm version (in the pacakge.json's engine).
Closing it until I can update all my repos to npm@7.
Peer dependencies breaking changes + windows env + non working --legacy-peer-deps flag 🤯

[rarkins]

For Renovate-related repos we have favored using the dependencyDashboardApproval feature for major updates. The downside is that you might forget them if they're "hidden" in an issue, but it works well for repos you are likely to check often enough. But yeah.. I wouldn't go rushing into npm 7