Repository navigation
[BUG] npm ci fails with architecture-related packages on lockfiles 11.17.0 and 11.16.0 #10043
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
This is not just a request to bump a dependency for a CVE
- This is not solely a request to bump a dependency for a CVE
Current Behavior
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: @napi-rs/nice-android-arm-eabi@ from lock file
npm error Missing: @napi-rs/nice-android-arm64@ from lock file
npm error Missing: @napi-rs/nice-darwin-arm-eabi@ from lock file
npm error Missing: @napi-rs/nice-darwin-x64@ from lock file
npm error Missing: @esbuild/aix-ppc64@ from lock file
npm error Missing: @esbuild/android-arm@ from lock file
npm error Missing: @esbuild/android-arm64@ from lock file
npm error Missing: @esbuild/android-x64@ from lock file
npm error Missing: @esbuild/darwin-arm64@ from lock file
npm error Missing: @esbuild/darwin-x64@ from lock file
npm error Missing: @esbuild/freebsd-arm64@ from lock file
npm error Missing: @esbuild/freebsd-x64@ from lock file
npm error Missing: @esbuild/linux-arm@ from lock file
npm error Missing: @esbuild/linux-arm64@ from lock file
npm error Missing: @esbuild/linux-ia32@ from lock file
npm error Missing: @esbuild/linux-loong64@ from lock file
npm error Missing: @esbuild/linux-mips64el@ from lock file
npm error Missing: @esbuild/linux-ppc64@ from lock file
npm error Missing: @esbuild/linux-riscv64@ from lock file
npm error Missing: @esbuild/linux-s390x@ from lock file
npm error Missing: @esbuild/netbsd-x64@ from lock file
npm error Missing: @esbuild/openbsd-x64@ from lock file
npm error Missing: @esbuild/sunos-x64@ from lock file
npm error Missing: @esbuild/win32-arm64@ from lock file
npm error Missing: @esbuild/win32-ia32@ from lock file
npm error Missing: @esbuild/win32-x64@ from lock file
npm error Missing: @rollup/rollup-android-arm-eabi@ from lock file
npm error Missing: @rollup/rollup-android-arm64@ from lock file
npm error Missing: @rollup/rollup-darwin-arm64@ from lock file
npm error Missing: @rollup/rollup-darwin-x64@ from lock file
npm error Missing: @rollup/rollup-linux-arm-gnueabihf@ from lock file
npm error Missing: @rollup/rollup-linux-arm-musleabihf@ from lock file
npm error Missing: @rollup/rollup-linux-arm64-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-arm64-musl@ from lock file
npm error Missing: @rollup/rollup-linux-powerpc64le-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-riscv64-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-s390x-gnu@ from lock file
npm error Missing: @rollup/rollup-win32-arm64-msvc@ from lock file
npm error Missing: @rollup/rollup-win32-ia32-msvc@ from lock file
npm error Missing: @rollup/rollup-win32-x64-msvc@ from lock file
npm error Missing: fsevents@ from lock file
This also seems to be happening to rolldown, unrs, msgpackr, lmdb, and parcel. Seems to only happen to the OS dependencies.
Noticing the package-lock.json file is removing lines like this for each
"node_modules/esbuild/node_modules//@esbuild/aix-ppc64": {
"dev": true,
"optional": true
}
...
I have added the allowScripts in the package.json like the following but I don't think this would cause the issue (it still removes them and complains if allow scripts is missing)
"allowScripts": {
"@parcel/watcher": true,
"esbuild": true,
"protobufjs": true,
"unrs-resolver": true
}
Expected Behavior
I expected npm ci to just install the packages as it always did with 11.11.0 and earlier
Steps To Reproduce
It seems since 11.17.0, npm fails as it removes "node_modules/esbuild/node_modules//@esbuild/aix-ppc64" and others out of the lock , but npm 11.11.0 and earlier keeps them in the lock and functions just fine.
Steps:
- Deleted the
package-lock.jsonfile andnode_modules - Ran
npm install - Ran
npm ci
this might be related to #8805 or #4828 to maybe something that has been undone to cause this issue
Environment
- npm: 11.17.0, 11.16.0
- Node.js: 24.19.0, 24.18.1
- OS Name: Linux
- System Model Name: Various
- npm config:
Activity
v-kchindam-infy commentedon Sep 28, 2026
@JadamNGC I couldn't reproduce This.
package.jsonor minimal repo that reproduces it.npm config lspackage-lock.jsongenerated by 11.16.0 vs 11.17.0JadamNGC commentedon Sep 28, 2026
@v-kchindam-infy
npm config:
Getting the diff of the package-lock here in a little bit but 11.16.0 and 11.17.0 are both removing the same things which cause the same error. Do you want a diff when it was working in 11.11.0 to both of those? Or do you just want the diff between 11.16.0 to 11.17.0?
JadamNGC commentedon Sep 28, 2026
Package.json
iloveyouto476-cloud commentedon Sep 29, 2026
{
"name": "name",
"version": "1.0.0-SNAPSHOT",
"systemVersion": "1.0.0",
"buildName": "",
"type": "module",
"scripts": {
"build": "npm run package",
"ng": "ng",
"package": "ng build --base-href .",
"prettier": "npx prettier --write",
"start": "ng serve",
"test": "jest --voverage=true --watch=false",
"test:watch": "jest --coverage=true --watch=true",
"lint": "ng lint --format ./sonarqube_formatter.js --output0file ./build/reports/eslint_report.json name --max-warnings=0"
}.
"dependencies": {
"@angular/cdk": "21.2.13",
"@angular/common": "21.2.15",
"@angular/compiler": "21.2.15",
"@angular/core": "21.2.15",
"@angular/forms": "21.2.15",
"@angular/material": "21.2.15",
"@angular/platform-browser": "21.2.15",
"@angular/platform-browswer-dynamic": "21.2.15",
"@angular/router": "21.2.15",
"@types/luxon": "3.7.1",
"angular-split": "20.0.0",
"atmospher.js": "5.0.26",
"ngx-mask": "21.1.0",
"rxjs": "7.8.2",
"tslib": "2.8.1"
},
"devDependencies": {
"@angular-devkit/build-angular": "21.2.13",
"@angular/cli": "21.2.13",
"@angular/compiler-cli": "21.2.15",
"@angular/material-luxon-adapter": "21.2.13",
"@types/jest": "30.0.0",
"@types/lodash-es": "4.17.12",
"@types/luxon": "3.7.1",
"@types/node": "22.13.9",
"angular-eslint": "21.4.0",
"eslint": "10.5.0",
"eslint-plugin-jsdoc": "62.9.0",
"eslint-plugin-no-only-tests": "3.3.0",
"lodash-es": "4.18.1",
"luxon": "3.7.2",
"ng-mocks": "14.15.3",
"postcss": "8.4.31",
"prettier": "3.9.4",
"ts-jest": "29.4.6",
"ts-mockito": "2.6.1",
"ts-node": "10.9.2",
"typescript": "5.9.3"
},
"overrides": {
"fast-glob": "3.3.3",
"cesium": {
"@cesium/engine": "22.3.0",
"@cesium/widgets": "14.2.0"
},
},
"allowScripts": {
"@parcel/watcher": true,
"esbuild": true,
"protobufjs": true,
"unrs-resolver": true
}
}
JadamNGC commentedon Sep 29, 2026
11.17.0 package-lock.json Diff
JadamNGC commentedon Oct 5, 2026
I think part of the problem is I am trying to only pull the packages for the environments I need. Now when I run the commands it seems to remove the omitted packages paths but then sees that they are used for dev dependencies with a
npm ci. Is there a way to only have the 2 enviorments I know I will be building it work with out pulling the other 10+ environment paths?JadamNGC commentedon Oct 9, 2026
This looks like it might be a similar issue to what I'm experiencing #10086
mvanhorn commentedon Oct 12, 2026
validateLockfilewalks every ideal-tree entry and treats a key missing from the virtual tree as lockfile drift.Shrinkwrap.commitomits inert nodes that have no package version, and those nodes are unresolved optional dependencies, so a lockfile that correctly left them out is reported as out of sync.Before the lockfile lookup,
validateLockfilenow skips an ideal-tree entry when it is inert andentry.package?.versionis absent.#10115