dependabot / dependabot/dependabot-core

Bug: Dependabot's npm engine error message does not display the actual npm version in use

Open
#15,085 0 comments 0 reactions 1 assignee Claimed by @v-thavaahariharangit View on GitHub
L: github:actions L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

11.8.0 (Dependabot environment; bug requires >=11.10.0)

### Language version

Node.js 24.15.0

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

_No response_

### Updated dependency

brace-expansion: update from 5.0.5→5.0.6, but bug applies to any package requiring min-release-age (npm >=11.10.0)

### What you expected to see, versus what you actually saw

I expected Dependabot's error message to precisely report the npm version in use when checking engine constraints. It reports:

npm error notsup Required: {"node":">=24.13.0","npm":">=11.10.0"}
npm error notsup Actual: {"node":"v24.15.0","npm":"11.8.0"}

However, Dependabot actually uses npm 11.12.1 (per the logs and public docs) for execution. The error message does not reflect the actual npm version in the environment, which is confusing and led me to debug with the wrong assumptions. The message should clearly explain what versions were actually used for the failing command to help diagnose new engine-dependent config (like min-release-age in npm >=11.10.0).

### Native package manager behavior

When I update with npm 11.12.1 (the version Dependabot claims to run internally per its own docs), the update works locally, but Dependabot emits an error about using 11.8.0. So the version check output is not matching the running CLI.

### Images of the diff or a link to the PR, issue, or logs

Full action log: https://github.com/DTS-STN/canadian-dental-care-plan/actions/runs/26051924675/job/76590408000

### Smallest manifest that reproduces the issue

A minimal package.json that uses:

{
"engines": {
"npm": ">=11.10.0"
},
"min-release-age": "7d"
}

triggers this on any package update with Dependabot at the time of writing.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.