EBADDEVENGINES when devEngines.packageManager.version is set higher than what comes with setup-node

[dmurvihill]

Description:
In package.json, if devEngines.packageManager.version is set higher than what is bundled with setup-node, the action fails. This prevents us from updating to a compliant version of NPM.

Action version:
v4

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:

Repro steps:

workflow/ci.yml

name: CI

on:
  workflow_dispatch:

jobs:
  do-node-modules:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/set-up-ci
        with:
          node-version: lts/*

action.yml

name: "Setup"
description: "Set up Node and install project dependencies"
inputs:
  node-version:
    description: Node version to set up
    # This shouldn't be required; but in practice node-version must be
    # set on Linux runners; otherwise updating NPM will fail.
    #
    # See https://github.com/actions/setup-node/issues/1409. When fixed,
    # this can be set back to false and then "node-version" will default
    # to whatever is specified "node-version-file".
    required: true
  npm-version:
    description: NPM version to use for the package
    default: 11.5.1

runs:
  using: "composite"
  steps:
    - uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}
        check-latest: true
        cache: "npm"
        cache-dependency-path: "package-lock.json"
    - name: install latest npm
      run: npm install -g npm@${{ inputs.npm-version }}
      shell: "bash"

Expected behavior:
Should be able to install NPM 11.5.1 and proceed with the rest of the pipeline.

Actual behavior:

Getting action download info
Download action repository 'actions/setup-node@v4' (SHA:49933ea5288caeca8642d1e84afbd3f7d6820020)
Run ./.github/actions/set-up-ci
  with:
    node-version: lts/*
    npm-version: 11.5.1
Run actions/setup-node@v4
  with:
    node-version: lts/*
    check-latest: true
    cache: npm
    cache-dependency-path: package-lock.json
    always-auth: false
    token: ***
Attempt to resolve LTS alias from manifest...
Attempt to resolve the latest version from manifest...
Resolved as '22.20.0'
Found in cache @ /opt/hostedtoolcache/node/22.20.0/x64
Environment details
  node: v22.20.0
  npm: 10.9.3
  yarn: 1.22.22
/opt/hostedtoolcache/node/22.20.0/x64/bin/npm config get cache
npm error code EBADDEVENGINES
npm error EBADDEVENGINES The developer of this package has specified the following through devEngines
npm error EBADDEVENGINES Invalid engine "packageManager"
npm error EBADDEVENGINES Invalid semver version "^11.5.1" does not match "10.9.3" for "packageManager"
npm error EBADDEVENGINES {
npm error EBADDEVENGINES   current: { name: 'npm', version: '10.9.3' },
npm error EBADDEVENGINES   required: { name: 'npm', version: '^11.5.1' }
npm error EBADDEVENGINES }
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-10-14T22_49_47_930Z-debug-0.log
Error: npm error code EBADDEVENGINES
npm error EBADDEVENGINES The developer of this package has specified the following through devEngines
npm error EBADDEVENGINES Invalid engine "packageManager"
npm error EBADDEVENGINES Invalid semver version "^11.5.1" does not match "10.9.3" for "packageManager"
npm error EBADDEVENGINES {
npm error EBADDEVENGINES   current: { name: 'npm', version: '10.9.3' },
npm error EBADDEVENGINES   required: { name: 'npm', version: '^11.5.1' }
npm error EBADDEVENGINES }
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-10-14T22_49_47_930Z-debug-0.log

[dmurvihill]

just reproed with v6 as well

[priyagupta108]

Hello @dmurvihill 👋,
Thank you for your report. We'll investigate the issue and get back to you with the details!