[BUG] npm ci fails with newer versions of npm

Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

I haven't been able to install 11.6.3, but 11.6.2, when running npm ci on an extremely simple package.json (and generating a branch new package-lock.json) it fails with:

npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: nopt@8.1.0 from lock file
npm error Missing: nopt@8.1.0 from lock file
npm error Missing: @npmcli/installed-package-contents@3.0.0 from lock file
npm error Missing: abbrev@3.0.1 from lock file
npm error Missing: abbrev@3.0.1 from lock file
npm error Missing: npm-bundled@4.0.0 from lock file
npm error Missing: npm-normalize-package-bin@4.0.0 from lock file

Expected Behavior

npm ci should install the packages that are listed in the package.json and package-lock.json

Steps To Reproduce

Create a simple package.json, run npm install, then run npm ci.

Environment

npm: 11.6.2
Node.js: 24.11.1
OS Name: Amazon Linux 2023/Debian
System Model Name: Mac OSX
npm config:

; "project" config from /workspaces/knowbot/.npmrc
 
@r3c-engineering:registry = "[https://npm.pkg.github.com/"](https://npm.pkg.github.com/%22)
//npm.pkg.github.com/:_authToken = (protected)
registry = "[https://registry.npmjs.org/"](https://registry.npmjs.org/%22)
 
; node bin location = /home/devuser/.nvm/versions/node/v24.11.1/bin/node
; node version = v24.11.1
; npm local prefix = /workspaces/knowbot
; npm version = 11.6.2
; cwd = /workspaces/knowbot
; HOME = /home/devuser
; Run `npm config ls -l` to show all defaults.

Could this be related to #8726?

Earlier issue (closed by the poster): #8669 - this broke in 11.6.2.

There's also #8674

We had this problem as well. We are using @semantic-release/npm in our devDependencies, which in turn uses npm@^11.6.2 as dependency.
As long as npm@11.6.2 was in the lock-file, everything was fine, but npm@11. 6.3 now uses nopt@9 instead of nopt@8.1.0.

I don't know exactly what's going wrong here, but fix could fix the problem by adding this to our package.json:

"overrides": {
    "@semantic-release/npm": {
      "npm": "11.6.2"
    },
  }

Can confirm - npm ci was breaking in our pipeline - npm was updated to 11.6.3 with the name nopt showing multiple in the package-lock.json

Rolling back to 11.6.0 worked for us

To those who have semantic-release in their dependencies:

I was able to fix this issue by uninstalling all devDependencies related to semantic-release (thanks to semantic-release/semantic-release#3951).

According to the updated semantic-release documentation, it’s now recommended not to install semantic-release locally at all. Since it’s a release-time dependency rather than a development dependency, they suggest installing it globally in the CI environment or using npx during the release step.

After removing the local devDependencies npm uninstall semantic-release @semantic-release/git @semantic-release/github, and re-running npm i then npm ci the issue was resolved for me.

@kherzieandal

@kherzieandal The reason I want it in my lockfile is so that I get a locked version for supply chain attacks.

semantic-release/semantic-release#3955

Confirming, for security and compliance reasons we must keep dependencies pinned (by hashed ref). Any changes have to be scanned and human reviewed before the pins are updated, and this is a process that is already automated.

Further, our CI is ephemeral, and root/global level changes are forbidden.

Switching to an unpinned global install will not fly.

Also a note; this is not only related to semantic-release. npm ci is failing in several respects.

#8777 #8726 #7622 #8758 #8693 #8740 #8669

Please use npm >= 11.6.3 to generate package-lock and when installing in CI. See problems with lower versions.

The issue remains with 11.6.3. others have reported the same.

fix(deps): Add npm overrides for Node.js 24 compatibility

yes, the issue is there with the latest version 11.10.0 as well,

basically it broke the every single build we had (10+) with similar errors, complaining about missing lock file, and to fix that, no one has any idea.

should have marked as major release

@ert78gb

I ran npm install twice just like @ert78gb suggested and it worked.

@pochat

@pochat: Running npm install twice shouldn't be needed anymore with the latest npm 11.12.1.

If you still have this bug with latest NPM, please provide minimal package.json to reproduce this, so we can fix it.

@Saibamen

Hi @Saibamen, thanks for your assistance.

I'll provide the information you requested. What exactly do you need to see for a minimal package.json?

You should provide package.json with as few packages as possible to trigger your bug, so the npm install will finish in seconds, not in minutes. All redundant packages should be removed.

@Saibamen

HI @Saibamen,

Here is the information. I have a fresh install of vuejs and nuxt.

npm -v
11.12.1

Package.json

{
"name": "front_end",
"type": "module",
"private": true,
"scripts": {
"build": "nuxt build",
"dev": "nuxt dev",
"generate": "nuxt generate",
"preview": "nuxt preview",
"postinstall": "nuxt prepare"
},
"dependencies": {
"nuxt": "^4.4.2",
"vue": "^3.5.31",
"vue-router": "^5.0.4"
}
}

Let me know if you need anything else.

Thank you for your time.

@pochat

Your dependencies are working for me without any problems in npm 11.12.1 and the latest NodeJS LTS.

{
  "name": "test_npm",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "dependencies": {
    "nuxt": "^4.4.2",
    "vue": "^3.5.31",
    "vue-router": "^5.0.4"
  }
}

Repro:

npm install
rmdir /s /q node_modules
npm ci

@pochat and @chr4ss12: Please remember that you need to delete node_modules folder and package-lock.json, then do npm install to recreate the correct lock file.

@Saibamen

Thank you for your time @Saibamen. I'll give that a try.

@Saibamen

Hi @Saibamen. It worked. Thanks again!

This was working fine up till 11.11.1 and broke again in 11.12.0 (broken in 11.12.1, 11.13.0) - the lock files are created without including optional dependencies.

@dominykas

@dominykas: Sounds like a different bug to me.
Please create a new issue and provide a minimal package.json file for your case, and which packages are missing.

There were multiple issues linked to this one:

The root cause of this issue was invalid lock files getting created?

But yes, I will create a new issue about this regression.

Edit: quite possibly this only related to npm installs that run with package-lock=false and then use npm shrinkwrap --dev. Might not bother raising an issue, because what's the point.

The root cause of this issue was invalid lock files getting created?

Yes, you need to recreate the lock file from scratch - delete node_modules folder, remove lock file, run npm install

And then you can delete node_modules folder and do npm ci to check if you have new errors.

Point is, invalid lock files are still getting created (if you have package-lock=false to avoid creating them automatically and then use npm shrinkwrap --dev to create them manually).

Or, to be more specific, I think this is related to the hidden lock file which always gets created (I think npm shrinkwrap just copies it over, doesn't it?) - I suspect the node_modules/.package-lock.json is still invalid.

Fix github action fails

Pin npm to 11.6.2 in EAS builds to dodge npm ci lockfile regression

Navigation Menu

Repository navigation

[BUG] npm ci fails with newer versions of npm #8767

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

5 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[BUG] npm ci fails with newer versions of npm #8767

Description

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

Activity

TheRealWaldo commented on Nov 21, 2025

dominykas commented on Nov 21, 2025

nknapp commented on Nov 21, 2025

tanepiper commented on Nov 21, 2025

kherzieandal commented on Nov 22, 2025

fardarter commented on Nov 24, 2025

SchroederSteffen commented on Nov 24, 2025

TheRealWaldo commented on Nov 24, 2025

TheRealWaldo commented on Nov 25, 2025

liamcmitchell commented on Dec 8, 2025

TheRealWaldo commented on Dec 9, 2025

chr4ss12 commented on Feb 13, 2026

5 remaining items

pochat commented on Apr 1, 2026

Saibamen commented on Apr 1, 2026

pochat commented on Apr 1, 2026

Saibamen commented on Apr 1, 2026

pochat commented on Apr 1, 2026

Saibamen commented on Apr 1, 2026

pochat commented on Apr 1, 2026

pochat commented on Apr 1, 2026

dominykas commented on Apr 24, 2026

Saibamen commented on Apr 24, 2026

dominykas commented on Apr 24, 2026

Saibamen commented on Apr 24, 2026

dominykas commented on May 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions