Resolve package-lock.json inconsistency for @babel/eslint-parser#77256
Merged
Resolve package-lock.json inconsistency for @babel/eslint-parser#77256
Conversation
The ESLint v10 upgrade (#76654) bumped @babel/eslint-parser to ^7.28.6 in packages/eslint-plugin/package.json, but package-lock.json was left resolving to 7.25.7. This mismatch caused `npm ci` to fail on trunk with "Missing: @babel/eslint-parser@7.28.6 from lock file". Regenerate the lock file so the declared and resolved versions match, restoring dependency integrity. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
t-hamano
changed the title
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
manzoorwanijk
approved these changes
Apr 13, 2026
Member
manzoorwanijk
left a comment
manzoorwanijk
left a comment
There was a problem hiding this comment.
Thank you for the fix.
I was wondering if we should have a PR check that checks for such inconsistencies?
|
Size Change: 0 B Total Size: 7.74 MB ℹ️ View Unchanged
|
Contributor
Author
I'm not sure why this inconsistency wasn't caught in the PR, but it would be great if it could be. |
|
Flaky tests detected in b01fdca. 🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/24324293714
|
Member
Yes, the reason is that if I run |
Member
|
There are a number of checks that are supposed to happen in a pull request to avoid lockfile drift being merged to trunk, so the fact that it did indicates something isn't working correctly. The fact that it fails on Haven't dug deeply, but a couple initial thoughts:
|
Member
|
It wasn't caught on the original pull request because it only fails on Node.js 24 (example job), and as of #72506 we only run tests for Node.js 20 on pull requests (related code). Comparing logs for Node 20 vs Node 24, you can see under "Setup Node.js and install dependencies" > "Environment details" that the NPM version is different (10.8.2 vs 11.11.0).
We identified and fixed this for static checks jobs only in #74222, so maybe we could following that approach for all tests? I think this is definitely related to the root problem identified in #72143. |
Member
|
Although I'd like to think if we can make progress on #72973, we could get rid of the matrix and run a single version of Node.js across all tests and branches. The lack of guarantee on npm versioning should be fixed though, since it otherwise will reemerge in the future (Node 26, 28, etc.). |
Contributor
Author
|
My investigation suggests this might be caused by the differences between npm 10 and 11. Please review the following test results. They compare the outcome after intentionally committing a dependency mismatch and then running npm Details~/projects/_core-dev/gutenberg test-npm-11 !1 node -v 1 ✘
v24.14.1
~/projects/_core-dev/gutenberg test-npm-11 !1 npm -v ✔
11.11.0
~/projects/_core-dev/gutenberg test-npm-11 !1 node -e 'const f="package-lock.json",fs=require("fs"),j=JSON.parse(fs.readFileSync(f));j.packages["node_modules/@babel/eslint-parser"].version="7.25.7";fs.writeFileSync(f,JSON.stringify(j,null,"\t")+"\n")'
~/projects/_core-dev/gutenberg test-npm-11 !1 git add . ✔
~/projects/_core-dev/gutenberg test-npm-11 +1 git commit -m "Intentionally cause dependency inconsistencies" ✔
✔ Preparing...
✔ Running tasks...
✔ Applying modifications...
✔ Cleaning up...
[test-npm-11 dd030d584bf] Intentionally cause dependency inconsistencies
1 file changed, 1 insertion(+), 1 deletion(-)
~/projects/_core-dev/gutenberg test-npm-11 npm ci ✔
npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Invalid: lock file's @babel/eslint-parser@7.25.7 does not satisfy @babel/eslint-parser@7.28.6
npm error
npm error Clean install a project
npm error
npm error Usage:
npm error npm ci
npm error
npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts]
npm error [--allow-git <all|none|root>] [--no-audit] [--no-bin-links] [--no-fund]
npm error [--dry-run]
npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm error [--workspaces] [--include-workspace-root] [--install-links]
npm error
npm error --install-strategy
npm error Sets the strategy for installing packages in node_modules.
npm error
npm error --legacy-bundling
npm error Instead of hoisting package installs in `node_modules`, install packages
npm error
npm error --global-style
npm error Only install direct dependencies in the top level `node_modules`,
npm error
npm error --omit
npm error Dependency types to omit from the installation tree on disk.
npm error
npm error --include
npm error Option that allows for defining which types of dependencies to install.
npm error
npm error --strict-peer-deps
npm error If set to `true`, and `--legacy-peer-deps` is not set, then _any_
npm error
npm error --foreground-scripts
npm error Run all build scripts (ie, `preinstall`, `install`, and
npm error
npm error --ignore-scripts
npm error If true, npm does not run scripts specified in package.json files.
npm error
npm error --allow-git
npm error Limits the ability for npm to fetch dependencies from git references.
npm error
npm error --audit
npm error When "true" submit audit reports alongside the current npm command to the
npm error
npm error --bin-links
npm error Tells npm to create symlinks (or `.cmd` shims on Windows) for package
npm error
npm error --fund
npm error When "true" displays the message at the end of each `npm install`
npm error
npm error --dry-run
npm error Indicates that you don't want npm to make any changes and that it should
npm error
npm error -w|--workspace
npm error Enable running a command in the context of the configured workspaces of the
npm error
npm error --workspaces
npm error Set to true to run the command in the context of **all** configured
npm error
npm error --include-workspace-root
npm error Include the workspace root when workspaces are enabled for a command.
npm error
npm error --install-links
npm error When set file: protocol dependencies will be packed and installed as
npm error
npm error
npm error aliases: clean-install, ic, install-clean, isntall-clean
npm error
npm error Run "npm help ci" for more info
npm error A complete log of this run can be found in: /home/t-hamano/.npm/_logs/2026-04-14T12_05_59_358Z-debug-0.lognpm Details~/projects/_core-dev/gutenberg test-npm-10 !1 node -v ✔
v24.14.1
~/projects/_core-dev/gutenberg test-npm-10 !1 npm -v ✔
10.9.8
~/projects/_core-dev/gutenberg test-npm-10 !1 node -e 'const f="package-lock.json",fs=require("fs"),j=JSON.parse(fs.readFileSync(f));j.packages["node_modules/@babel/eslint-parser"].version="7.25.7";fs.writeFileSync(f,JSON.stringify(j,null,"\t")+"\n")'
~/projects/_core-dev/gutenberg test-npm-10 !1 git add . ✔
~/projects/_core-dev/gutenberg test-npm-10 +1 git commit -m "Intentionally cause dependency inconsistencies" ✔
✔ Preparing...
✔ Running tasks...
✔ Applying modifications...
✔ Cleaning up...
[test-npm-10 a9be98dee5a] Intentionally cause dependency inconsistencies
1 file changed, 1 insertion(+), 1 deletion(-)
~/projects/_core-dev/gutenberg test-npm-10 npm ci ✔
npm warn deprecated @babel/plugin-proposal-private-methods@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-methods instead.
npm warn deprecated @babel/plugin-proposal-optional-catch-binding@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-catch-binding instead.
npm warn deprecated @babel/plugin-proposal-numeric-separator@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-numeric-separator instead.
npm warn deprecated @babel/plugin-proposal-nullish-coalescing-operator@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.
npm warn deprecated @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
npm warn deprecated figgy-pudding@3.5.2: This module is no longer supported.
npm warn deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm warn deprecated typedoc-plugin-resolve-crossmodule-references@0.3.3: Upgrade to typedoc >= 0.24 and remove typedoc-plugin-resolve-crossmodule-references from your dependencies
npm warn deprecated trim@0.0.1: Use String.prototype.trim() instead
npm warn deprecated source-map-resolve@0.6.0: See https://github.com/lydell/source-map-resolve#deprecated
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm warn deprecated @babel/plugin-proposal-optional-chaining@7.21.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm warn deprecated source-map-url@0.4.0: See https://github.com/lydell/source-map-url#deprecated
npm warn deprecated @babel/plugin-proposal-object-rest-spread@7.20.7: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
npm warn deprecated @babel/plugin-proposal-async-generator-functions@7.20.7: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-async-generator-functions instead.
npm warn deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies
npm warn deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm warn deprecated source-map-resolve@0.5.2: See https://github.com/lydell/source-map-resolve#deprecated
> gutenberg@22.9.0 postinstall
> patch-package && node ./patches/patch-xcode.js
patch-package 8.0.0
Applying patches...
lighthouse@12.2.2 ✔
react-autosize-textarea@7.1.0 ✔
react-devtools-core@4.28.5 ✔
react-native@0.73.3 ✔
> gutenberg@22.9.0 prepare
> husky install
husky - Git hooks installed
added 4801 packages, and audited 4949 packages in 55s
464 packages are looking for funding
run `npm fund` for details
123 vulnerabilities (17 low, 27 moderate, 72 high, 7 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details. |
Member
The long term solution is to be explicit about package manager version in CI, instead of relying upon what comes bundled with Node. That way, we can also separately manage the package manager version, regardless of the Node version, allowing us to use the latest version of package manager without much infra changes needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Follow up to #76654.
Resolve a
package-lock.jsoninconsistency for@babel/eslint-parserso thatnpm cisucceeds ontrunk.Why?
The ESLint v10 upgrade (#76654) bumped
@babel/eslint-parserto^7.28.6inpackages/eslint-plugin/package.json, butpackage-lock.jsonwas left resolving to7.25.7. As a result,npm ciontrunkfails with:How?
Ran
npm installlocally to regeneratepackage-lock.jsonUse of AI Tools
Claude Code was used to investigate the CI failure, identify the lock file mismatch, and draft this PR description. All changes were reviewed by the author.