[BUG] npm update generates package-lock.json that isn't considered in-sync by npm ci

Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

Take this package.json:

{
    "private": true,
    "name": "repro-app",
    "version": "1.0.0",
    "license": "UNLICENSED",
    "type": "module",
    "dependencies": {
        "@tanstack/react-start": "1.133.2",
        "@tanstack/nitro-v2-vite-plugin": "1.132.40"
    }
}

Running npm update and then npm ci shows following error:

npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: crossws@0.3.5 from lock file
npm error Missing: crossws@0.3.5 from lock file
npm error Missing: crossws@0.3.5 from lock file

Git diff after running npm update:

diff --git a/package-lock.json b/package-lock.json
index adc1001..92601e6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3258,6 +3258,16 @@
                 "node": ">= 8"
             }
         },
+        "node_modules/crossws": {
+            "version": "0.3.5",
+            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
+            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
+            "license": "MIT",
+            "peer": true,
+            "dependencies": {
+                "uncrypto": "^0.1.3"
+            }
+        },
         "node_modules/css-select": {
             "version": "5.2.2",
             "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.2.2.tgz",
@@ -4011,15 +4021,6 @@
             "integrity": "sha512-+W7VmiVINB+ywl1HGXJXmrqkOhpKrIiVZV6tQuV54ZyQC7MMuBt81Vc336GMLoHBq5hV/F9eXgt5Mnx0Rha5Fg==",
             "license": "MIT"
         },
-        "node_modules/h3/node_modules/crossws": {
-            "version": "0.3.5",
-            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
-            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
-            "license": "MIT",
-            "dependencies": {
-                "uncrypto": "^0.1.3"
-            }
-        },
         "node_modules/hasown": {
             "version": "2.0.2",
             "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
@@ -4554,15 +4555,6 @@
                 "listhen": "bin/listhen.mjs"
             }
         },
-        "node_modules/listhen/node_modules/crossws": {
-            "version": "0.3.5",
-            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
-            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
-            "license": "MIT",
-            "dependencies": {
-                "uncrypto": "^0.1.3"
-            }
-        },
         "node_modules/listhen/node_modules/pathe": {
             "version": "1.1.2",
             "resolved": "https://registry.npmjs.org/pathe/-/pathe-1.1.2.tgz",
@@ -4907,15 +4899,6 @@
                 "url": "https://paulmillr.com/funding/"
             }
         },
-        "node_modules/nitropack/node_modules/crossws": {
-            "version": "0.3.5",
-            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
-            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
-            "license": "MIT",
-            "dependencies": {
-                "uncrypto": "^0.1.3"
-            }
-        },
         "node_modules/nitropack/node_modules/readdirp": {
             "version": "4.1.2",
             "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",

Expected Behavior

Running npm update should produce a lock file that is considered "in sync" by npm ci

Steps To Reproduce

Clone https://github.com/ulrichstark/unstable-npm-lock-file-repro.git
Run npm update
Run npm ci

Environment

npm: 11.6.2
Node.js: v24.10.0
OS Name: macOS Tahoe 26.0.1
System Model Name: Macbook Pro M4
npm config:

; node bin location = /Users/ulrichstark/.nvm/versions/node/v24.10.0/bin/node
; node version = v24.10.0
; npm local prefix = /Users/ulrichstark/Desktop/unstable-npm-lock-file-repro
; npm version = 11.6.2
; cwd = /Users/ulrichstark/Desktop/unstable-npm-lock-file-repro
; HOME = /Users/ulrichstark

I guess this is a duplicate of #8669

I guess this is a duplicate of #8669

I'm not sure. My issue is also present in 11.6.0 while your linked issue seems to have appeared first in 11.6.2.

Also #6787 sounds similar, but is about npm install and not about npm update

I also mentioned on #8669 that I had a similar issue at least in 11.6.1 not sure if it was also in 11.6.0 but the outcome looks very familiar

Please use npm >= 11.6.3 to generate package-lock and when installing in CI. See problems with lower versions.

Please use npm >= 11.6.3 to generate package-lock and when installing in CI. See problems with lower versions.

Thanks, but the issue is still present even when using npm 11.6.4.

Tested with #8981:

npm ci: OK (both from 11.10.0 and PR #8981 (448db52))

npm ls (the same output for both versions):

repro-app@1.0.0 C:\DEV\npm_test\8674
+-- @tanstack/nitro-v2-vite-plugin@1.132.40
+-- @tanstack/react-start@1.133.2
`-- crossws@0.4.4 extraneous

git diff between package-lock.json files from the first npm install - NPM 11.10.0 vs NPM from PR #8981 (448db52):

diff --git a/package-lock.json b/package-lock.json
index 01c7dca..50cf207 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2915,9 +2915,9 @@
             "license": "MIT"
         },
         "node_modules/b4a": {
-            "version": "1.7.5",
-            "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.7.5.tgz",
-            "integrity": "sha512-iEsKNwDh1wiWTps1/hdkNdmBgDlDVZP5U57ZVOlt+dNFqpc/lpPouCIxZw+DYBgc4P9NDfIZMPNR4CHNhzwLIA==",
+            "version": "1.8.0",
+            "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.0.tgz",
+            "integrity": "sha512-qRuSmNSkGQaHwNbM7J78Wwy+ghLEYF1zNrSeMxj4Kgw6y33O3mXcQ6Ie9fRvfU/YnxWkOchPXbaLb73TkIsfdg==",
             "license": "Apache-2.0",
             "peerDependencies": {
                 "react-native-b4a": "*"
@@ -3467,12 +3467,18 @@
             }
         },
         "node_modules/crossws": {
-            "version": "0.3.5",
-            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
-            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
+            "version": "0.4.4",
+            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.4.4.tgz",
+            "integrity": "sha512-w6c4OdpRNnudVmcgr7brb/+/HmYjMQvYToO/oTrprTwxRUiom3LYWU1PMWuD006okbUWpII1Ea9/+kwpUfmyRg==",
+            "extraneous": true,
             "license": "MIT",
-            "dependencies": {
-                "uncrypto": "^0.1.3"
+            "peerDependencies": {
+                "srvx": ">=0.7.1"
+            },
+            "peerDependenciesMeta": {
+                "srvx": {
+                    "optional": true
+                }
             }
         },
         "node_modules/css-select": {
@@ -4267,6 +4273,15 @@
             "integrity": "sha512-+W7VmiVINB+ywl1HGXJXmrqkOhpKrIiVZV6tQuV54ZyQC7MMuBt81Vc336GMLoHBq5hV/F9eXgt5Mnx0Rha5Fg==",
             "license": "MIT"
         },
+        "node_modules/h3/node_modules/crossws": {
+            "version": "0.3.5",
+            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
+            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
+            "license": "MIT",
+            "dependencies": {
+                "uncrypto": "^0.1.3"
+            }
+        },
         "node_modules/hasown": {
             "version": "2.0.2",
             "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
@@ -4806,6 +4821,15 @@
                 "listhen": "bin/listhen.mjs"
             }
         },
+        "node_modules/listhen/node_modules/crossws": {
+            "version": "0.3.5",
+            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
+            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
+            "license": "MIT",
+            "dependencies": {
+                "uncrypto": "^0.1.3"
+            }
+        },
         "node_modules/listhen/node_modules/pathe": {
             "version": "1.1.2",
             "resolved": "https://registry.npmjs.org/pathe/-/pathe-1.1.2.tgz",
@@ -5154,6 +5178,15 @@
                 "url": "https://paulmillr.com/funding/"
             }
         },
+        "node_modules/nitropack/node_modules/crossws": {
+            "version": "0.3.5",
+            "resolved": "https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz",
+            "integrity": "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==",
+            "license": "MIT",
+            "dependencies": {
+                "uncrypto": "^0.1.3"
+            }
+        },
         "node_modules/nitropack/node_modules/readdirp": {
             "version": "5.0.0",
             "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",

Fixed in NPM 11.10.1. Please update your NPM:
npm install -g npm@latest

Fixed in NPM 11.10.1. Please update your NPM: npm install -g npm@latest

Yes, I can confirm that the issue seems to be fixed with this version. Thank you very much!

Navigation Menu

Repository navigation

[BUG] `npm update` generates package-lock.json that isn't considered in-sync by `npm ci` #8674

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[BUG] npm update generates package-lock.json that isn't considered in-sync by npm ci #8674

Description

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

Activity

DaSchTour commented on Oct 15, 2025

ulrichstark commented on Oct 15, 2025

ulrichstark commented on Oct 15, 2025

DaSchTour commented on Oct 16, 2025

liamcmitchell commented on Dec 8, 2025

ulrichstark commented on Dec 9, 2025

Saibamen commented on Feb 19, 2026

Saibamen commented on Feb 19, 2026

ulrichstark commented on Feb 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[BUG] `npm update` generates package-lock.json that isn't considered in-sync by `npm ci` #8674