The authorization header can interfere with caching because npmjs doesn’t return “public” in the “Cache-Control” header.

npmjs has fixed/lowered the cache expiry time now

Closes #2363

Added content as suggested/contributed by @swashata.

Closes https://github.com/renovatebot/config-help/issues/71

Changes PR body to show both homepage and source repo if both are present in the datasource metadata.

Closes #2387

npm’s —package-lock-only implementation seems to have a bug and produces incorrect lock files when file: references are present. If file: dependencies are detected, skipInstalls is set to false.

Closes #2401

Ref: https://npm.community/t/scoped-packages-have-latest-version-disappear-temporarily-soon-after-publish/633/7

fix(docker): exclude calico/node from being marked as Node.js

Closes #2391

chore: update node.js to v8.11.4

Adds new admin option “skipInstalls” that is applicable for npm-only for now (including lerna-npm). If set to false, Renovate will perform a full install of modules rather than `—package-lock-only`. This is necessary in some cases to work around bugs in npm.

Self-hosted bot users can set this option themselves on the bot’s config, but app users will require it to be enabled per-repository by the app admin.

If the current value is already unstable then we presume the user is happy to take newer unstable versions. However we should not presume that they want to keep jumping versions if so and instead would prefer to stabilise.

Discussed in #2258 but does not close it

Necessary because of https://npm.community/t/scoped-packages-have-latest-version-disappear-temporarily-soon-after-publish/633

Until the npmjs registry can return consistent results, we need to disable roll back PRs.

Closes #2148

Contains GitHub specific changes from #2323