Repository navigation
EBADDEVENGINES when devEngines.packageManager.version is set higher than what comes with setup-node #1410
Description
Description:
In package.json, if devEngines.packageManager.version is set higher than what is bundled with setup-node, the action fails. This prevents us from updating to a compliant version of NPM.
Action version:
v4
Platform:
- Ubuntu
- macOS
- Windows
Runner type:
- Hosted
- Self-hosted
Tools version:
Repro steps:
workflow/ci.yml
name: CI
on:
workflow_dispatch:
jobs:
do-node-modules:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/set-up-ci
with:
node-version: lts/*action.yml
name: "Setup"
description: "Set up Node and install project dependencies"
inputs:
node-version:
description: Node version to set up
# This shouldn't be required; but in practice node-version must be
# set on Linux runners; otherwise updating NPM will fail.
#
# See https://github.com/actions/setup-node/issues/1409. When fixed,
# this can be set back to false and then "node-version" will default
# to whatever is specified "node-version-file".
required: true
npm-version:
description: NPM version to use for the package
default: 11.5.1
runs:
using: "composite"
steps:
- uses: actions/setup-node@v4
with:
node-version: ${{ inputs.node-version }}
check-latest: true
cache: "npm"
cache-dependency-path: "package-lock.json"
- name: install latest npm
run: npm install -g npm@${{ inputs.npm-version }}
shell: "bash"Expected behavior:
Should be able to install NPM 11.5.1 and proceed with the rest of the pipeline.
Actual behavior:
Getting action download info
Download action repository 'actions/setup-node@v4' (SHA:49933ea5288caeca8642d1e84afbd3f7d6820020)
Run ./.github/actions/set-up-ci
with:
node-version: lts/*
npm-version: 11.5.1
Run actions/setup-node@v4
with:
node-version: lts/*
check-latest: true
cache: npm
cache-dependency-path: package-lock.json
always-auth: false
token: ***
Attempt to resolve LTS alias from manifest...
Attempt to resolve the latest version from manifest...
Resolved as '22.20.0'
Found in cache @ /opt/hostedtoolcache/node/22.20.0/x64
Environment details
node: v22.20.0
npm: 10.9.3
yarn: 1.22.22
/opt/hostedtoolcache/node/22.20.0/x64/bin/npm config get cache
npm error code EBADDEVENGINES
npm error EBADDEVENGINES The developer of this package has specified the following through devEngines
npm error EBADDEVENGINES Invalid engine "packageManager"
npm error EBADDEVENGINES Invalid semver version "^11.5.1" does not match "10.9.3" for "packageManager"
npm error EBADDEVENGINES {
npm error EBADDEVENGINES current: { name: 'npm', version: '10.9.3' },
npm error EBADDEVENGINES required: { name: 'npm', version: '^11.5.1' }
npm error EBADDEVENGINES }
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-10-14T22_49_47_930Z-debug-0.log
Error: npm error code EBADDEVENGINES
npm error EBADDEVENGINES The developer of this package has specified the following through devEngines
npm error EBADDEVENGINES Invalid engine "packageManager"
npm error EBADDEVENGINES Invalid semver version "^11.5.1" does not match "10.9.3" for "packageManager"
npm error EBADDEVENGINES {
npm error EBADDEVENGINES current: { name: 'npm', version: '10.9.3' },
npm error EBADDEVENGINES required: { name: 'npm', version: '^11.5.1' }
npm error EBADDEVENGINES }
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-10-14T22_49_47_930Z-debug-0.log
Activity
dmurvihill commentedon Oct 14, 2025
just reproed with v6 as well
v-priyagupta108 commentedon Oct 15, 2025
Hello @dmurvihill 👋,
Thank you for your report. We'll investigate the issue and get back to you with the details!
v-gowridurgad commentedon Nov 4, 2025
Hi @dmurvihill, Thanks for reporting this issue and providing detailed information.
The error occurred because, at the time of your workflow run, the lts/* alias in
actions/setup-nodewas resolving to Node 22, which shipped with npm 10.x. Since your project’s devEngines.packageManager.version required ^11.5.1, the npm version bundled with Node 22 didn’t meet that requirement, causing the engine validation to fail.This issue is now resolved because the Node.js LTS alias (lts/*) has been updated to point to Node 24 instead of Node 22. Node 24 comes bundled with a newer npm version (11.x), which now satisfies the engine requirement specified in your package.json.
We tested this on our end and confirmed that the workflow runs successfully without the EBADDEVENGINES error. A screenshot is attached for reference.
Please validate from your side and let us know if you have any further questions or need clarification.
dmurvihill commentedon Nov 4, 2025
Hi @gowridurgad, it is working for me now. That said, this issue will come up again when NPM releases version 12 and people start updating their
devEngines, so a permanent solution is still needed.v-gowridurgad commentedon Nov 10, 2025
Hi @dmurvihill, Glad to hear it's working now! You're correct that this issue can happen again with future npm releases (such as v12).
The root cause is that npm itself validates the required package manager version against the actually installed version, based on your devEngines.packageManager.version field in package.json. This validation happens internally in npm and is not handled automatically by setup-node. So, if the bundled npm version with the Node LTS runner is older than your required version, npm install fails with an EBADDEVENGINES error, regardless of how setup-node is configured.
You can handle this in one of the following ways:
1. Explicitly set a Node version that bundles the required npm:
Instead of using lts/*, specify a Node version that comes with the npm version you need:
This ensures the runner’s npm version satisfies devEngines.packageManager.version without extra steps.
2. Upgrade npm immediately after setup-node:
Use setup-node to install Node, then explicitly upgrade npm to match your devEngines requirement:
This guarantees the required npm version regardless of the bundled version with Node LTS.
Please feel free to reach out if you have any other questions or need further assistance!
dmurvihill commentedon Nov 10, 2025
Item 2 did not work. That's what this bug is about.
v-gowridurgad commentedon Nov 12, 2025
Hi @dmurvihill, My earlier suggestion about upgrading npm after setup-node won’t work because npm enforces engine validation before running any commands, so upgrading npm afterward cannot fix it. I apologize for the oversight.
The reliable workaround is to specify a Node version in setup-node that already includes the npm version your devEngines.packageManager requires. This ensures the npm version matches your project’s requirements from the start.
v-gowridurgad commentedon Nov 24, 2025
Hi @dmurvihill, Just a gentle reminder regarding this issue, If you have any updates or need further assistance, Please let us know.
v-gowridurgad commentedon Dec 1, 2025
Hi @dmurvihill,
Just a gentle reminder regarding this issue, If you have any updates or need further assistance, Please let us know.
v-gowridurgad commentedon Dec 9, 2025
Hi @dmurvihill,
Due to inactivity, I'm going to close this issue for now.
If you run into the same problem in the future, please follow the suggestion discussed above.
If you have further questions or need assistance, feel free to reopen this issue or create a new one.
Thanks!
flevi29 commentedon May 16, 2026
@gowridurgad This is a pretty big problem for us. How would you pre-install a specific NPM version? With PNPM I know they have their own action, but for NPM there isn't a standard and trusted one as far as I could find.
Right now our only solution is to always install the exact Node.js version that comes with the exact NPM version we require.
Alternatively we could move to PNPM, but we can't do that yet, and probably for a long time.