npm: support node constraints filtering

[rarkins]

What would you like Renovate to be able to do?

Skip proposing package updates if they don't meet the engines.node constraints of the package.json being updated.

Did you already have any implementation ideas?

I thought for sure this has been discussed in an issue before, and I recall a back and forth with @ljharb on it, however I cannot find any existing issue so creating this one.

If the repo package.json has no engines.node constraint then this is not applicable.

If the package's updated release(s) contain no engines.node constraints then this is also not applicable.

This is applicable if both the repo package.json and the newer versions package.json contain node constraints.

Here's what I propose:

• As done already, we extract constraints.node during npm manager extraction, and this gets passed through to the datasource lookup
• The npm datasource should be "constraint agnostic" and return all releases, but make sure to include constraints.node with each release if applicable
• Renovate should then do this evaluation:
• Query and cache (perhaps hourly) a list of all Node.js versions
• Filter the full node.js release list again the repo's constraint, and then against each release's constraint. Results for these constraints can also be cached for the period as an optimization.
• If the release's list is not a superset of the repository's release list (e.g. the repo needs to support node 10 but the new release does not) then the release is marked with skipReason: "incompatible" and not proposed as an update

The idea is that Renovate does not propose npm dependency updates unless they are compatible with the engines.node specified in the package.json.

One edge case I can think of: what if the current version in the package.json is already not compatible with the engines.node value in the same package.json? Should we skip this constraints check altogether and log a WARN instead?

Another edge case: what if it's a git/github npm dependency instead of npm? Today we don't dig into the package.json to extract a constraint, and I'm not sure we want to make that requirement of the v1 of this feature.

[HonkingGoose]

I guess https://github.com/renovatebot/renovate/issues/2443 and #4826 are related as well?

[rarkins]

Yes, it's #4826! Somehow that escaped my issue searches. I'll close this as a duplicate.

[HonkingGoose]

Yay! I finally linked the proper issue for once! 😄 🚀