dependabot / dependabot/dependabot-core
Bug: Dependabot's npm engine error message does not display the actual npm version in use
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
npm
### Package manager version
11.8.0 (Dependabot environment; bug requires >=11.10.0)
### Language version
Node.js 24.15.0
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
_No response_
### Updated dependency
brace-expansion: update from 5.0.5→5.0.6, but bug applies to any package requiring min-release-age (npm >=11.10.0)
### What you expected to see, versus what you actually saw
I expected Dependabot's error message to precisely report the npm version in use when checking engine constraints. It reports:
npm error notsup Required: {"node":">=24.13.0","npm":">=11.10.0"}
npm error notsup Actual: {"node":"v24.15.0","npm":"11.8.0"}
However, Dependabot actually uses npm 11.12.1 (per the logs and public docs) for execution. The error message does not reflect the actual npm version in the environment, which is confusing and led me to debug with the wrong assumptions. The message should clearly explain what versions were actually used for the failing command to help diagnose new engine-dependent config (like min-release-age in npm >=11.10.0).
### Native package manager behavior
When I update with npm 11.12.1 (the version Dependabot claims to run internally per its own docs), the update works locally, but Dependabot emits an error about using 11.8.0. So the version check output is not matching the running CLI.
### Images of the diff or a link to the PR, issue, or logs
Full action log: https://github.com/DTS-STN/canadian-dental-care-plan/actions/runs/26051924675/job/76590408000
### Smallest manifest that reproduces the issue
A minimal package.json that uses:
{
"engines": {
"npm": ">=11.10.0"
},
"min-release-age": "7d"
}
triggers this on any package update with Dependabot at the time of writing.
Contributor guide
Assessment
This issue has not been assessed yet.