Repo using pnpm appears to not be using the NPM_TOKEN from secrets

[eamonnsullivan]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.123.8

Please tell us more about your question or problem

We have many repos using the Mend app and we use automerging extensively. Most of our repos are using npm as a package manager and they are working fine. We provide an NPM_TOKEN in our secrets and they are able to check the versions of private packages in our organisation.

However, we have one repo using the pnpm package manager. It has only one internal, private dependency, but the checks are failing (so not automerges are happening) because it's getting a 404 on that dependency. (The error is (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=913)).

Looking closely at the logs for two jobs, one working on an npm repo and the other failing, I don't see these lines in the failing one:

DEBUG: Migrating npmToken to npmrc
{
  "npmToken": "***********"
}

DEBUG: Adding npmrc to config
DEBUG: Setting npmrc from decrypted config
DEBUG: Setting npmrc
DEBUG: Adding token authentication for https://registry.npmjs.org/ (hostType=npm) to hostRule

They're just missing, even though the two repos appear to be using the exact same config. Can anyone suggest something I'm missing or an avenue of investigation? Thanks.

Logs (if relevant)

Logs

INFO: Renovate started
{
  "renovateVersion": "43.123.8"
}

DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in /runner/renovate/cf1/config_file.json
DEBUG: No additional config file found specified - skipping
DEBUG: Detected config in env RENOVATE_CONFIG
{
  "config": {
    "extends": [
      "mergeConfidence:all-badges"
    ],
    "prFooter": "This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/{{platform}}/{{repository}}).",
    "binarySource": "install",
    "globalExtends": [
      "global:safeEnv"
    ],
    "logLevelRemap": [
      {
        "newLogLevel": "info",
        "matchMessage": "Cache fallback URLs"
      }
    ],
    "platformCommit": "enabled",
    "allowedCommands": [
      "^git add --all$",
      "^git reset$",
      "^pwd$"
    ],
    "repositoryCache": "enabled",
    "cacheTtlOverride": {
      "datasource-docker-hub-tags": 90,
      "datasource-maven:metadata-xml": 90
    },
    "encryptedWarning": "Encrypted secrets were detected in the repository config. This feature has been deprecated. Please migrate them to this portal. See the guide at http://docs.renovatebot.com/mend-hosted/migrating-secrets/",
    "onboardingConfig": {
      "$schema": "https://docs.renovatebot.com/renovate-schema.json",
      "extends": [
        "config:recommended"
      ]
    },
    "gitIgnoredAuthors": [
      "29139614+renovate[bot]@users.noreply.github.com"
    ],
    "customizeDashboard": {
      "repoProblemsHeader": "These problems occurred while renovating this repository. [View logs](https://developer.mend.io//{{platform}}/{{repository}})."
    },
    "repositoryCacheType": "local",
    "onboardingAutoCloseAge": 366,
    "allowedUnsafeExecutions": [
      "gradleWrapper"
    ],
    "dependencyDashboardFooter": "\n- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository\n",
    "dependencyDashboardHeader": "This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.<br>[View this repository on the Mend.io Web Portal](https://developer.mend.io/{{platform}}/{{repository}})."
  }
}

DEBUG: File config
{
  "config": {
    "token": "***********",
    "redisUrl": "rediss://**redacted**@master.developer-platform-bare-metal-prd-auth.aqffol.use1.cache.amazonaws.com:6379",
    "hostRules": [
      {
        "hostType": "docker",
        "matchHost": "docker.io",
        "username": "mdpprod3renovate",
        "password": "***********"
      },
      {
        "hostType": "docker",
        "matchHost": "hub.docker.com",
        "username": "mdpprodrenovatedc2",
        "password": "***********"
      }
    ],
    "secrets": {
      "NPM_TOKEN": "***********"
    }
  }
}

DEBUG: Additional file config
{
  "config": {}
}

DEBUG: CLI config
{
  "config": {}
}

DEBUG: Env config
{
  "config": {
    "extends": [
      "mergeConfidence:all-badges"
    ],
    "prFooter": "This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/{{platform}}/{{repository}}).",
    "binarySource": "install",
    "globalExtends": [
      "global:safeEnv"
    ],
    "logLevelRemap": [
      {
        "newLogLevel": "info",
        "matchMessage": "Cache fallback URLs"
      }
    ],
    "platformCommit": "enabled",
    "allowedCommands": [
      "^git add --all$",
      "^git reset$",
      "^pwd$"
    ],
    "repositoryCache": "enabled",
    "cacheTtlOverride": {
      "datasource-docker-hub-tags": 90,
      "datasource-maven:metadata-xml": 90
    },
    "encryptedWarning": "Encrypted secrets were detected in the repository config. This feature has been deprecated. Please migrate them to this portal. See the guide at http://docs.renovatebot.com/mend-hosted/migrating-secrets/",
    "onboardingConfig": {
      "$schema": "https://docs.renovatebot.com/renovate-schema.json",
      "extends": [
        "config:recommended"
      ]
    },
    "gitIgnoredAuthors": [
      "29139614+renovate[bot]@users.noreply.github.com"
    ],
    "customizeDashboard": {
      "repoProblemsHeader": "These problems occurred while renovating this repository. [View logs](https://developer.mend.io//{{platform}}/{{repository}})."
    },
    "repositoryCacheType": "local",
    "onboardingAutoCloseAge": 366,
    "allowedUnsafeExecutions": [
      "gradleWrapper"
    ],
    "dependencyDashboardFooter": "\n- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository\n",
    "dependencyDashboardHeader": "This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.<br>[View this repository on the Mend.io Web Portal](https://developer.mend.io/{{platform}}/{{repository}}).",
    "hostRules": [],
    "mode": "silent",
    "onboardingNoDeps": "enabled",
    "cacheDir": "/runner/cache",
    "forkProcessing": "enabled",
    "platform": "github",
    "username": "renovate[bot]",
    "repositories": [
      "bbc/arco"
    ],
    "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
    "deleteConfigFile": true
  }
}

DEBUG: Resolved global extends
{
  "config": {
    "allowedEnv": [
      "BUN_CONFIG_MAX_HTTP_REQUESTS",
      "GO*",
      "GRADLE_OPTS",
      "RUSTC_BOOTSTRAP"
    ],
    "description": [
      "Hopefully safe environment variables to allow users to configure."
    ]
  }
}

DEBUG: Combined config
{
  "config": {
    "allowedEnv": [
      "BUN_CONFIG_MAX_HTTP_REQUESTS",
      "GO*",
      "GRADLE_OPTS",
      "RUSTC_BOOTSTRAP"
    ],
    "description": [
      "Hopefully safe environment variables to allow users to configure."
    ],
    "token": "***********",
    "redisUrl": "rediss://**redacted**@master.developer-platform-bare-metal-prd-auth.aqffol.use1.cache.amazonaws.com:6379",
    "hostRules": [
      {
        "hostType": "docker",
        "matchHost": "docker.io",
        "username": "mdpprod3renovate",
        "password": "***********"
      },
      {
        "hostType": "docker",
        "matchHost": "hub.docker.com",
        "username": "mdpprodrenovatedc2",
        "password": "***********"
      }
    ],
    "secrets": {
      "NPM_TOKEN": "***********"
    },
    "extends": [
      "mergeConfidence:all-badges"
    ],
    "prFooter": "This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/{{platform}}/{{repository}}).",
    "binarySource": "install",
    "logLevelRemap": [
      {
        "newLogLevel": "info",
        "matchMessage": "Cache fallback URLs"
      }
    ],
    "platformCommit": "enabled",
    "allowedCommands": [
      "^git add --all$",
      "^git reset$",
      "^pwd$"
    ],
    "repositoryCache": "enabled",
    "cacheTtlOverride": {
      "datasource-docker-hub-tags": 90,
      "datasource-maven:metadata-xml": 90
    },
    "encryptedWarning": "Encrypted secrets were detected in the repository config. This feature has been deprecated. Please migrate them to this portal. See the guide at http://docs.renovatebot.com/mend-hosted/migrating-secrets/",
    "onboardingConfig": {
      "$schema": "https://docs.renovatebot.com/renovate-schema.json",
      "extends": [
        "config:recommended"
      ]
    },
    "gitIgnoredAuthors": [
      "29139614+renovate[bot]@users.noreply.github.com"
    ],
    "customizeDashboard": {
      "repoProblemsHeader": "These problems occurred while renovating this repository. [View logs](https://developer.mend.io//{{platform}}/{{repository}})."
    },
    "repositoryCacheType": "local",
    "onboardingAutoCloseAge": 366,
    "allowedUnsafeExecutions": [
      "gradleWrapper"
    ],
    "dependencyDashboardFooter": "\n- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository\n",
    "dependencyDashboardHeader": "This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.<br>[View this repository on the Mend.io Web Portal](https://developer.mend.io/{{platform}}/{{repository}}).",
    "mode": "silent",
    "onboardingNoDeps": "enabled",
    "cacheDir": "/runner/cache",
    "forkProcessing": "enabled",
    "platform": "github",
    "username": "renovate[bot]",
    "repositories": [
      "bbc/arco"
    ],
    "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
    "deleteConfigFile": true
  }
}

DEBUG: Enabling forkProcessing while in non-autodiscover mode
DEBUG: Enabling onboardingNoDeps while in non-autodiscover mode
DEBUG: Found valid git version: 2.53.0
DEBUG: Setting global hostRules
DEBUG: Adding password authentication for docker.io (hostType=docker) to hostRules
DEBUG: Adding password authentication for hub.docker.com (hostType=docker) to hostRules
DEBUG: Using default github endpoint: https://api.github.com/
DEBUG: Platform config
{
  "platformConfig": {
    "hostType": "github",
    "endpoint": "https://api.github.com/",
    "isGHApp": true,
    "isGhe": false
  },
  "renovateUsername": "renovate[bot]"
}

DEBUG: Using configured gitAuthor (renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>)
DEBUG: Adding token authentication for api.github.com (hostType=github) to hostRules
DEBUG: Using baseDir: /tmp/renovate
DEBUG: Using configured cacheDir: /runner/cache
DEBUG: Using containerbaseDir: /runner/cache/containerbase
DEBUG: Redis cache init
DEBUG: Redis cache connected
DEBUG: Commits limit = null
DEBUG: Setting global hostRules
DEBUG: Adding password authentication for docker.io (hostType=docker) to hostRules
DEBUG: Adding password authentication for hub.docker.com (hostType=docker) to hostRules
DEBUG: Adding token authentication for api.github.com (hostType=github) to hostRules
DEBUG: validatePresets()
DEBUG: Reinitializing hostRules for repo
DEBUG: Clearing hostRules
DEBUG: Adding password authentication for docker.io (hostType=docker) to hostRules
DEBUG: Adding password authentication for hub.docker.com (hostType=docker) to hostRules
DEBUG: Adding token authentication for api.github.com (hostType=github) to hostRules
INFO: Repository started
{
  "renovateVersion": "43.123.8"
}

DEBUG: Using localDir: /tmp/renovate/repos/github/bbc/arco
DEBUG: PackageFiles.clear() - Package files deleted
DEBUG: initRepo("bbc/arco")
DEBUG: hostRules: authentication already set for api.github.com
DEBUG: Using queue: host=api.github.com, concurrency=16
DEBUG: bbc/arco default branch = main
DEBUG: Issues cache: Adding 1 issues to reconcile queue
DEBUG: Using app token for git init
DEBUG: fetchBranchCommits(): url=https://**redacted**@github.com/bbc/arco.git
DEBUG: Repository cache is restored from revision 13
DEBUG: Resetting npmrc
DEBUG: Resetting npmrc
DEBUG: checkOnboarding()
DEBUG: isOnboarded()
DEBUG: Silent mode enabled so repo is considered onboarded
DEBUG: Repo is onboarded
DEBUG: http cache: Using cached response: https://api.github.com/repos/bbc/arco/contents/renovate.json from 2026-04-20T15:20:50.632Z
DEBUG: migrateAndValidate()
DEBUG: No config migration necessary
DEBUG: http cache: Using cached response: https://api.github.com/repos/bbc/passports-core/contents/renovate-config/default.json from 2026-04-20T15:20:50.734Z
DEBUG: http cache: Using cached response: https://api.github.com/repos/bbc/passports-core/contents/renovate-config/packageRules.json from 2026-04-20T15:20:51.524Z
DEBUG: Found repo ignorePaths
{
  "ignorePaths": [
    "**/node_modules/**",
    "**/bower_components/**",
    "**/vendor/**",
    "**/examples/**",
    "**/__tests__/**",
    "**/test/**",
    "**/tests/**",
    "**/__fixtures__/**"
  ]
}

INFO: Repository is running with mode=silent and will not make Issues or PRs by default

[jamietanna]

OK, so it looks like:

• You're setting NPM_TOKEN as a secret
• You're not setting any host rules
• When Renovate is looking up the private dependency (@e.../p...), this fails
• For other branches, when Renovate executes pnpm this works

(Job ID of note: 626eaefe-5566-4865-9afd-fe9cff43a0bb)

We've got some tweaks to the docs planned around how private packages work, but it looks like you've hit the case where you need to set both NPM_TOKEN and a Host Rule inside the Mend Developer Platform

[jamietanna]

This is because the NPM_TOKEN is only used by the actual pnpm invocation - Renovate does not use it for its own lookups to the npm registry

[eamonnsullivan]

Thank you! I'll give that a go.