Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: @napi-rs/nice-android-arm-eabi@ from lock file
npm error Missing: @napi-rs/nice-android-arm64@ from lock file
npm error Missing: @napi-rs/nice-darwin-arm-eabi@ from lock file
npm error Missing: @napi-rs/nice-darwin-x64@ from lock file
npm error Missing: @esbuild/aix-ppc64@ from lock file
npm error Missing: @esbuild/android-arm@ from lock file
npm error Missing: @esbuild/android-arm64@ from lock file
npm error Missing: @esbuild/android-x64@ from lock file
npm error Missing: @esbuild/darwin-arm64@ from lock file
npm error Missing: @esbuild/darwin-x64@ from lock file
npm error Missing: @esbuild/freebsd-arm64@ from lock file
npm error Missing: @esbuild/freebsd-x64@ from lock file
npm error Missing: @esbuild/linux-arm@ from lock file
npm error Missing: @esbuild/linux-arm64@ from lock file
npm error Missing: @esbuild/linux-ia32@ from lock file
npm error Missing: @esbuild/linux-loong64@ from lock file
npm error Missing: @esbuild/linux-mips64el@ from lock file
npm error Missing: @esbuild/linux-ppc64@ from lock file
npm error Missing: @esbuild/linux-riscv64@ from lock file
npm error Missing: @esbuild/linux-s390x@ from lock file
npm error Missing: @esbuild/netbsd-x64@ from lock file
npm error Missing: @esbuild/openbsd-x64@ from lock file
npm error Missing: @esbuild/sunos-x64@ from lock file
npm error Missing: @esbuild/win32-arm64@ from lock file
npm error Missing: @esbuild/win32-ia32@ from lock file
npm error Missing: @esbuild/win32-x64@ from lock file
npm error Missing: @rollup/rollup-android-arm-eabi@ from lock file
npm error Missing: @rollup/rollup-android-arm64@ from lock file
npm error Missing: @rollup/rollup-darwin-arm64@ from lock file
npm error Missing: @rollup/rollup-darwin-x64@ from lock file
npm error Missing: @rollup/rollup-linux-arm-gnueabihf@ from lock file
npm error Missing: @rollup/rollup-linux-arm-musleabihf@ from lock file
npm error Missing: @rollup/rollup-linux-arm64-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-arm64-musl@ from lock file
npm error Missing: @rollup/rollup-linux-powerpc64le-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-riscv64-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-s390x-gnu@ from lock file
npm error Missing: @rollup/rollup-win32-arm64-msvc@ from lock file
npm error Missing: @rollup/rollup-win32-ia32-msvc@ from lock file
npm error Missing: @rollup/rollup-win32-x64-msvc@ from lock file
npm error Missing: fsevents@ from lock file
This also seems to be happening to rolldown, unrs, msgpackr, lmdb, and parcel. Seems to only happen to the OS dependencies.
Noticing the package-lock.json file is removing lines like this for each
"node_modules/esbuild/node_modules//@esbuild/aix-ppc64": {
"dev": true,
"optional": true
}
...
I have added the allowScripts in the package.json like the following but I don't think this would cause the issue (it still removes them and complains if allow scripts is missing)
"allowScripts": {
"@parcel/watcher": true,
"esbuild": true,
"protobufjs": true,
"unrs-resolver": true
}
Expected Behavior
I expected npm ci to just install the packages as it always did with 11.11.0 and earlier
Steps To Reproduce
It seems since 11.17.0, npm fails as it removes "node_modules/esbuild/node_modules//@esbuild/aix-ppc64" and others out of the lock , but npm 11.11.0 and earlier keeps them in the lock and functions just fine.
Steps:
- Deleted the
package-lock.json file and node_modules
- Ran
npm install
- Ran
npm ci
this might be related to #8928 to maybe something that has been undone to cause this issue
Environment
- npm: 11.17.0, 11.16.0
- Node.js: 24.19.0, 24.18.1
- OS Name: Linux
- System Model Name: Various
- npm config:
Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
This also seems to be happening to rolldown, unrs, msgpackr, lmdb, and parcel. Seems to only happen to the OS dependencies.
Noticing the package-lock.json file is removing lines like this for each
I have added the allowScripts in the
package.jsonlike the following but I don't think this would cause the issue (it still removes them and complains if allow scripts is missing)Expected Behavior
I expected npm ci to just install the packages as it always did with 11.11.0 and earlier
Steps To Reproduce
It seems since 11.17.0, npm fails as it removes "node_modules/esbuild/node_modules//@esbuild/aix-ppc64" and others out of the lock , but npm 11.11.0 and earlier keeps them in the lock and functions just fine.
Steps:
package-lock.jsonfile andnode_modulesnpm installnpm cithis might be related to #8928 to maybe something that has been undone to cause this issue
Environment