Shrinkwrap + npm bug + rollup's os-specific subpackages make it impossible to `npm ci` when using netlify-cli as a local dependency

[angelikatyborska]

Describe the bug

I have just started migrating my Astro projects from Vercel to Netlify and I hit this bug that I'm unsure how to handle.

Prerequisites for triggering the bug

• I use npm as a package manager in my project
• I installed netlify-cli in my project as a local dependency
• netlify-cli has a shrinkwrap file
• netlify-cli depends on rollup, which depends on os-specific packages like @rollup/rollup-android-arm-eabi, @rollup/rollup-android-arm64, and so on.

The bug

I am unable to run npm ci after adding netlify-cli to my project. It crashes with the following error:

$ npm ci
11.2.0
npm error code EBADPLATFORM
npm error notsup Unsupported platform for @rollup/rollup-android-arm-eabi@4.52.2: wanted {"os":"android","cpu":"arm"} (current: {"os":"darwin","cpu":"arm64"})
npm error notsup Valid os:   android
npm error notsup Actual os:  darwin
npm error notsup Valid cpu:  arm
npm error notsup Actual cpu: arm64
npm error A complete log of this run can be found in: /Users/angelikacathor/.npm/_logs/2025-11-10T14_51_35_010Z-debug-0.log

I created a very simple repository to reproduce the bug, see "steps to reproduce".

The underlying cause has been reported to npm (npm/cli#7622), but they don't seem to be in hurry to fix it (reported over a year ago).

My assumptions

• npm is a widely-used package manager so Netlify would want to fully support it.
• Installing netlify-cli as a local dependency is supported because the docs suggest doing so.
• Running npm ci instead of npm install is a good practice because it only installs exactly the dependencies and versions listed in the lock file.

Solutions?

Does anyone else out here experience the same problem? I didn't see it reported yet.

Can Netlify do anything to help?

I understand that technically npm should fix the underlying cause, but they aren't doing it. Could you somehow create a second version of the netlify-cli package meant for local installations that doesn't have a shrinkwrap file? I saw that there were other complaints about the shrinkwrap. Or maybe there is a way to get rid of those os-specific rollup packages from the shrinkwrap without affecting any functionality? Or maybe at least the documentation should be appended to warn about this problem and how to work around it? Assuming I'm not the only one that this happens to.

Possible workarounds?

I could see a few possible workarounds on my side, but all of them are potentially disrupting:

• Switch to a different package manager
  • Not great because it's lot of work, many of my projects are affected, might bring about other bugs and limitations.
• Switch to using netlify-cli globally
  • Not great because I will lose the ability to ensure that each team member and the CI are running the same version.
• Give up on using npm ci
  • Not great because it will make CI runs less useful for catching problems early, and make deployments more risky.

Did anyone else try any of those workarounds? Am I missing something? Any advice would be appreciated!

Steps to reproduce

1. Clone the repository https://github.com/angelikatyborska/netlify-cli-test
2. Open a terminal, navigate to the repository, and run npm ci

Configuration

No response

Environment

System:
OS: macOS 26.1
CPU: (11) arm64 Apple M3 Pro
Memory: 91.16 MB / 18.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 22.14.0 - /Users/angelikacathor/.asdf/installs/nodejs/22.14.0/bin/node
npm: 11.2.0 - /Users/angelikacathor/.asdf/plugins/nodejs/shims/npm
pnpm: 10.12.4 - /Users/angelikacathor/Library/pnpm/pnpm
bun: 1.2.15 - /Users/angelikacathor/.bun/bin/bun

[taylorreece]

I just ran into this on the latest netlify-cli version, too. https://github.com/prismatic-io/embedded-workflow-builder-docs/actions/runs/19334870655/job/55306967240?pr=10

I ended up removing netlify-cli from my dev dependencies and opted to install it with --global instead. prismatic-io/embedded-workflow-builder-docs@e19a8fb

I guess that's fine for now? Dependabot can't track it, which stinks, but I'll just keep an eye on this repo instead.

[serhalp]

Oof, this is a weird one.

It seems nothing actually changed in netlify-cli itself here that would cause this. As evidence, here's the diff from 23.9.5 to 23.11.0 — the same bump as in @taylorreece's PR. There are no relevant changes to android packages.

It's in @taylorreece's bump PR itself that the optional: true android (etc.) native packages get erroneously changed to extraneous: true, resulting in the... also erroneous npm validation triggering 😓.

Interestingly, we only have these two reports of this occurring. I'm not sure what the exact necessary conditions are or how widespread this is.

As a workaround, you could perhaps use pnpm? or npm install instead of npm ci?

[G-Rath]

Using npm install is not the worst short-term workaround, but just want to highlight:

• its not reasonable to switch to a whole different package manager as a workaround, unless you're actively not supporting the package manager this is breaking on
• npm ci provides assurances that npm install does not i.e. immutable installing

Both of these are important aspects to security and compliance

[serhalp]

Of course, I was just brainstorming workarounds for this NPM CLI bug — as far as I can tell it is not an issue with the Netlify CLI.

By the way @G-Rath are you also experiencing this? That would be a third report. Do you have any information about when this was introduced for you? in a particular version of netlify-cli? or of npm?

[G-Rath]

Yes I am, in trying to update from v23.5.1 to v23.11.0*.

Give me a few minutes and I'll get you some details

*: I just realised a version was released 4 hours ago, so actually when I posted my comment on the other issue I was upgrading to v23.10.0, so I can now say that this isn't fixed in v23.11.0

[G-Rath]

So we do npm ci in our CI, so while we've not used every individual version of the cli, I can say we've used a number of them (updating to address security patches, cause shrinkwrap) and this is the first time we've seen this issue.

For NPM versions, again I've not tried every exact version but doing the majors it looks to happen all the way back to v9 - I have produced it on:

• 11.2.0
• 11.0.0
• 10.9.3
• 10.0.0
• 9.9.4
• 9.0.0

[G-Rath]

ok looks like this was introduced in v23.10.0 - I just tested the versions between 23.5.1 and 23.11.0, and it starts happening on 23.10.0

[serhalp]

Those are fantastic details, thank you @G-Rath! We'll take a closer look.

[Ari-Kishon]

Just wanted to bump and say this happened to us aswell,

Would love to get notified when this is fixed, for now im pinning my version to 23.9.5

[philiprenich]

Throwing in another data point that I've had this happen as well, rolling back to Netlify@23.9.5 solved it for me. Thanks @G-Rath for that info!