Skip to content

[BUG] npm install installs an invalid tree (as validated by npm ci) #5854

Closed
#8981
Closed
[BUG] npm install installs an invalid tree (as validated by npm ci)#5854
#8981
Labels
Bugthing that needs fixingPriority 1high priority issueRelease 9.xwork is associated with a specific npm 9 release

Description

@billyjanitsch
billyjanitsch
opened on Nov 14, 2022

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

See the two commits in this repo.

The first commit is the result of running:

> npm install @pmmmwh/react-refresh-webpack-plugin@0.5.9 read-pkg-up@7.0.1
added 135 packages in 6s

This command exits without error, and correctly installs to node_modules/ and package-lock.json. However, the resulting tree is invalid, according to npm ci:

❯ npm ci
npm ERR! code EUSAGE
npm ERR! 
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.

The second commit is the result of running npm install again. This updates the package lock to a valid tree, and npm ci now completes successfully.

Expected Behavior

It shouldn't be necessary to run npm install twice to get a valid tree.

Steps To Reproduce

See current behavior for a minimal repro repository.

Environment

  • npm: 9.1.1
  • Node.js: 18.12.0
  • OS Name: macOS
  • System Model Name: MacBook Pro (16-inch, 2019)
  • npm config: none

Activity

  1. billyjanitsch
    added
    Bugthing that needs fixing
    Needs Triageneeds review for next steps
    Release 9.xwork is associated with a specific npm 9 release
    on Nov 14, 2022

  2. wraithgar commented on Nov 17, 2022

    @wraithgar
    wraithgar
    on Nov 17, 2022
    Contributor

    @pmmmwh/react-refresh-webpack-plugin is asking for a peerDependency of type-fest that is incompatible with what read-pkg-up is asking for as a dependency. npm is hoisting what read-pkg-up wants, colliding w/ what @pmmmwh/react-refresh-webpack-plugin wants as its peer dep

    ~/D/n/s/file $ npm view @pmmmwh/react-refresh-webpack-plugin@0.5.9 peerDependencies["type-fest"]
>=0.17.0 <4.0.0
~/D/n/s/file $ npm view read-pkg-up@7.0.1 dependencies["type-fest"]
^0.8.1
~/D/n/s/file $ npm query '#type-fest'|json -a _id location from
type-fest@0.6.0 node_modules/read-pkg/node_modules/type-fest [
  "node_modules/read-pkg"
]
type-fest@0.8.1 node_modules/type-fest [
  "node_modules/read-pkg-up",
  "node_modules/@pmmmwh/react-refresh-webpack-plugin"
]
  3. wraithgar
    added
    Priority 1high priority issue
    and removed
    Needs Triageneeds review for next steps
    on Nov 17, 2022
  4. jpg619
    assigned
    jpg619
    and unassigned
    jpg619
    on Sep 22, 2023

  5. Saibamen commented on Feb 19, 2026

    @Saibamen
    Saibamen
    on Feb 19, 2026
    Contributor

    Tested with #8981:

    npm ci: OK (both from 11.10.0 and PR #8981 (448db52))

    npm ls (the same output for both versions):

    npm-install-bug@1.0.0 C:\DEV\npm_test\5854
+-- @pmmmwh/react-refresh-webpack-plugin@0.5.17
+-- read-pkg-up@7.0.1
`-- type-fest@4.41.0 extraneous

    git diff between package-lock.json files from the first npm install - NPM 11.10.0 vs NPM from PR #8981 (448db52):

    diff --git a/package-lock.json b/package-lock.json
index 25d6a7c..bf64132 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1074,6 +1074,15 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/read-pkg-up/node_modules/type-fest": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
+      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/read-pkg/node_modules/type-fest": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.6.0.tgz",
@@ -1336,12 +1345,16 @@
       }
     },
     "node_modules/type-fest": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
-      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "version": "4.41.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
+      "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
+      "extraneous": true,
       "license": "(MIT OR CC0-1.0)",
       "engines": {
-        "node": ">=8"
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/undici-types": {
  6. owlstronaut
    closed this as completedon Feb 19, 2026

  7. Saibamen commented on Feb 19, 2026

    @Saibamen
    Saibamen
    on Feb 19, 2026
    Contributor

    Fixed in NPM 11.10.1. Please update your NPM:
    npm install -g npm@latest

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingPriority 1high priority issueRelease 9.xwork is associated with a specific npm 9 release

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions