Repository navigation
[BUG] lockfile changes upon fresh reinstall #8563
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Lock file changes on a fresh npm i, even though it should be finalized.
Expected Behavior
Lock file should be finalized and not change.
Steps To Reproduce
mkdir npm-cli-lockfile-bug
cd npm-cli-lockfile-bug
npm init -y
npm i electron-builder
echo "node_modules/" > .gitignore
git init
git add .
git commit -m "Initial commit"
git clean -fdx
npm i
git --no-pager diff
git diff should not have any changes, but instead it shows:
diff --git a/package-lock.json b/package-lock.json
index 785990a..7ac0e6b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -298,43 +298,6 @@
"url": "https://github.com/sponsors/isaacs"
}
},
- "node_modules/@electron/windows-sign": {
- "version": "1.2.2",
- "resolved": "https://registry.npmjs.org/@electron/windows-sign/-/windows-sign-1.2.2.tgz",
- "integrity": "sha512-dfZeox66AvdPtb2lD8OsIIQh12Tp0GNCRUDfBHIKGpbmopZto2/A8nSpYYLoedPIHpqkeblZ/k8OV0Gy7PYuyQ==",
- "license": "BSD-2-Clause",
- "optional": true,
- "peer": true,
- "dependencies": {
- "cross-dirname": "^0.1.0",
- "debug": "^4.3.4",
- "fs-extra": "^11.1.1",
- "minimist": "^1.2.8",
- "postject": "^1.0.0-alpha.6"
- },
- "bin": {
- "electron-windows-sign": "bin/electron-windows-sign.js"
- },
- "engines": {
- "node": ">=14.14"
- }
- },
- "node_modules/@electron/windows-sign/node_modules/fs-extra": {
- "version": "11.3.1",
- "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz",
- "integrity": "sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==",
- "license": "MIT",
- "optional": true,
- "peer": true,
- "dependencies": {
- "graceful-fs": "^4.2.0",
- "jsonfile": "^6.0.1",
- "universalify": "^2.0.0"
- },
- "engines": {
- "node": ">=14.14"
- }
- },
"node_modules/@gar/promisify": {
"version": "1.1.3",
"resolved": "https://registry.npmjs.org/@gar/promisify/-/promisify-1.1.3.tgz",
@@ -1380,14 +1343,6 @@
"buffer": "^5.1.0"
}
},
- "node_modules/cross-dirname": {
- "version": "0.1.0",
- "resolved": "https://registry.npmjs.org/cross-dirname/-/cross-dirname-0.1.0.tgz",
- "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
- "license": "MIT",
- "optional": true,
- "peer": true
- },
"node_modules/cross-spawn": {
"version": "7.0.6",
"resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@@ -3018,34 +2973,6 @@
"node": ">=10.4.0"
}
},
- "node_modules/postject": {
- "version": "1.0.0-alpha.6",
- "resolved": "https://registry.npmjs.org/postject/-/postject-1.0.0-alpha.6.tgz",
- "integrity": "sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==",
- "license": "MIT",
- "optional": true,
- "peer": true,
- "dependencies": {
- "commander": "^9.4.0"
- },
- "bin": {
- "postject": "dist/cli.js"
- },
- "engines": {
- "node": ">=14.0.0"
- }
- },
- "node_modules/postject/node_modules/commander": {
- "version": "9.5.0",
- "resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
- "integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
- "license": "MIT",
- "optional": true,
- "peer": true,
- "engines": {
- "node": "^12.20.0 || >=14"
- }
- },
"node_modules/proc-log": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/proc-log/-/proc-log-2.0.1.tgz",
if you now delete node_modules and package-lock.json and run npm i, generated lock file will again list node_modules/@electron/windows-sign.
Every fresh creation of lock file has this package included, and any fresh reinstallation of that existing lock file re-removes it.
Environment
- npm: 11.6.0
- Node.js: 24.8.0
- OS Name: Fedora 42
- npm config:
avi@fedora:~$ npm config ls
; "user" config from /home/avi/.npmrc
//registry.npmjs.org/:_authToken = (protected)
; node bin location = /home/avi/.nvm/versions/node/v24.8.0/bin/node
; node version = v24.8.0
; npm local prefix = /home/avi
; npm version = 11.6.0
; cwd = /home/avi
; HOME = /home/avi
; Run `npm config ls -l` to show all defaults.
Activity
AviVahl commentedon Sep 14, 2025
Probably a duplicate of #8535 (for a different dependency), so closing.