Renovate "Artifact update error" / lock file maintenance failed in CI

By Daniel Zoghalchali·Latchkey

To keep lockfiles in sync, Renovate runs the ecosystem tool (npm, yarn, poetry, bundler) inside its environment. When that command fails, Renovate attaches an "Artifact update error" to the PR and leaves the lockfile unupdated.

What this error means

A Renovate PR shows an "Artifact update error" section, or lockFileMaintenance PRs fail, with a log pointing to a missing binary, a registry auth failure, or a native build error.

WARN: Artifact update error
  fileName: package-lock.json
  stderr: npm error code E401 - Incorrect or missing credentials for registry

Common causes

The lockfile tool cannot reach a private registry

The refresh command needs credentials for a private feed that Renovate's environment does not have, so it fails with an auth error.

A missing tool or native build during refresh

The required package manager version or a native postinstall step is unavailable in the Renovate environment.

How to fix it

Provide registry credentials via hostRules

1. Add a hostRules entry with the token for the private registry.
2. Reference the token from an encrypted value or environment secret.
3. Re-run Renovate so the lockfile refresh authenticates.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "hostRules": [
    {
      "matchHost": "pkgs.internal.example.com",
      "hostType": "npm",
      "token": "{{ secrets.NPM_INTERNAL_TOKEN }}"
    }
  ]
}

Ensure the needed tool version is available

Pin the package manager Renovate should use (for example via constraints) so the lockfile refresh runs with a compatible binary.

How to prevent it

• Configure hostRules for every private registry a lockfile touches.
• Pin package-manager versions Renovate must run.
• Avoid postinstall builds that must run during a lockfile refresh.

Frequently asked questions

Related guides

References

• GitHub Actions documentation