[BC BREAK] version 11.6.2 breaks CI

[ro0NL]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Hi,

We notice our CI starts failing for the following patch update:

Package	Update	Change
npm	patch	11.6.0 -> 11.6.2

Producing:

 > [build 7/9] RUN --mount=type=cache,target=/root/.npm     npm clean-install --legacy-peer-deps --logs-max=0:
2.769 npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
2.769 npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
2.769 npm error [--no-bin-links] [--no-fund] [--dry-run]
2.769 npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
2.769 npm error [--workspaces] [--include-workspace-root] [--install-links]
2.769 npm error
2.769 npm error aliases: clean-install, ic, install-clean, isntall-clean
2.769 npm error
2.769 npm error Run "npm help ci" for more info
2.770 npm error Log files were not written due to the config logs-max=0

If i manually fiddle with it in a container, i see debug log:

 `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.

But im not sure why our package.json and package-lock.json wouldnt be in sync ...

We always kept our package-lock.json in sync using npm clean-install --legacy-peer-deps && npm install --legacy-peer-deps --package-lock-only

Is there a related change in this patch release?

Expected Behavior

No response

Steps To Reproduce

No response

Environment

• npm: 11.6.2
• Node.js: 22.19
• OS Name: Ubunutu
• System Model Name: Gitub Actions
• npm config:

; "user" config from /root/.npmrc

engine-strict = true

; node bin location = /usr/local/bin/node
; node version = v22.19.0
; npm local prefix = /app
; npm version = 11.6.2
; cwd = /app
; HOME = /root
; Run `npm config ls -l` to show all defaults.

[ro0NL]

i can confirm 11.6.1 still works correctly:

#11 23.88 added 1441 packages, and audited 1442 packages in 24s
#11 23.88 
#11 23.88 48 packages are looking for funding
#11 23.88   run `npm fund` for details
#11 23.95 
...
#11 23.95 
#11 23.95 To address issues that do not require attention, run:
#11 23.95   npm audit fix
#11 23.95 
#11 23.95 To address all issues possible (including breaking changes), run:
#11 23.95   npm audit fix --force
#11 23.95 
#11 23.95 Some issues need review, and may require choosing
#11 23.95 a different dependency.
#11 23.95 
#11 23.95 Run `npm audit` for details.
#11 23.95 npm notice
#11 23.95 npm notice New patch version of npm available! 11.6.1 -> 11.6.2
#11 23.95 npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.6.2
#11 23.95 npm notice To update run: npm install -g npm@11.6.2
#11 23.95 npm notice

[ebachle]

We're also seeing this, potentially specifically around optionalDependencies:

#14 [build-base  3/16] RUN npm ci --omit=dev &&     cp -r node_modules /tmp/prod_node_modules  &&     npm ci
#14 5.540 npm warn EBADENGINE Unsupported engine {
#14 5.540 npm warn EBADENGINE   package: 'warehouse-service@1.0.0',
#14 5.540 npm warn EBADENGINE   required: { node: '^22.14.0', npm: '^10.2' },
#14 5.540 npm warn EBADENGINE   current: { node: 'v22.16.0', npm: '11.6.2' }
#14 5.540 npm warn EBADENGINE }
#14 5.563 npm error code EUSAGE
#14 5.568 npm error
#14 5.568 npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
#14 5.568 npm error
#14 5.568 npm error Missing: @parcel/watcher-android-arm64@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-darwin-x64@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-freebsd-x64@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-linux-arm-glibc@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-linux-arm-musl@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-linux-arm64-glibc@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-linux-arm64-musl@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-linux-x64-glibc@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-linux-x64-musl@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-win32-arm64@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-win32-ia32@2.5.1 from lock file
#14 5.568 npm error Missing: @parcel/watcher-win32-x64@2.5.1 from lock file
#14 5.568 npm error Missing: @swc/core-darwin-x64@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-linux-arm-gnueabihf@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-linux-arm64-gnu@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-linux-arm64-musl@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-linux-x64-gnu@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-linux-x64-musl@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-win32-arm64-msvc@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-win32-ia32-msvc@1.5.29 from lock file
#14 5.568 npm error Missing: @swc/core-win32-x64-msvc@1.5.29 from lock file
#14 5.568 npm error Missing: @nx/nx-darwin-x64@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-freebsd-x64@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-arm-gnueabihf@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-arm64-gnu@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-arm64-musl@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-x64-gnu@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-x64-musl@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-win32-arm64-msvc@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-win32-x64-msvc@20.8.2 from lock file
#14 5.568 npm error Missing: @nx/nx-darwin-x64@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-freebsd-x64@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-arm-gnueabihf@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-arm64-gnu@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-arm64-musl@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-x64-gnu@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-linux-x64-musl@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-win32-arm64-msvc@20.4.0 from lock file
#14 5.568 npm error Missing: @nx/nx-win32-x64-msvc@20.4.0 from lock file
#14 5.568 npm error
#14 5.568 npm error Clean install a project
#14 5.568 npm error
#14 5.568 npm error Usage:
#14 5.568 npm error npm ci
#14 5.568 npm error
#14 5.568 npm error Options:
#14 5.568 npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
#14 5.568 npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
#14 5.568 npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
#14 5.568 npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
#14 5.568 npm error [--no-bin-links] [--no-fund] [--dry-run]
#14 5.568 npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
#14 5.568 npm error [--workspaces] [--include-workspace-root] [--install-links]
#14 5.568 npm error
#14 5.568 npm error aliases: clean-install, ic, install-clean, isntall-clean

This is coming from entries in the package-lock.json that look something like this:

        "node_modules/@parcel/watcher": {
            "version": "2.5.1",
            "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.1.tgz",
            "integrity": "sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==",
            "dev": true,
            "hasInstallScript": true,
            "optional": true,
            "dependencies": {
                "detect-libc": "^1.0.3",
                "is-glob": "^4.0.3",
                "micromatch": "^4.0.5",
                "node-addon-api": "^7.0.0"
            },
            "engines": {
                "node": ">= 10.0.0"
            },
            "funding": {
                "type": "opencollective",
                "url": "https://opencollective.com/parcel"
            },
            "optionalDependencies": {
                "@parcel/watcher-android-arm64": "2.5.1",
                "@parcel/watcher-darwin-arm64": "2.5.1",
                "@parcel/watcher-darwin-x64": "2.5.1",
                "@parcel/watcher-freebsd-x64": "2.5.1",
                "@parcel/watcher-linux-arm-glibc": "2.5.1",
                "@parcel/watcher-linux-arm-musl": "2.5.1",
                "@parcel/watcher-linux-arm64-glibc": "2.5.1",
                "@parcel/watcher-linux-arm64-musl": "2.5.1",
                "@parcel/watcher-linux-x64-glibc": "2.5.1",
                "@parcel/watcher-linux-x64-musl": "2.5.1",
                "@parcel/watcher-win32-arm64": "2.5.1",
                "@parcel/watcher-win32-ia32": "2.5.1",
                "@parcel/watcher-win32-x64": "2.5.1"
            }
        },

Our experience is also that rollback to npm@11.6.1 fixes this.

[Tezra]

This issue may be related to this issue. A possible work around is to run npm install twice in a row. (once to install/update, and once to fix minor lock discrepancies)

[ro0NL]

@Tezra

We always kept our package-lock.json in sync using npm clean-install --legacy-peer-deps && npm install --legacy-peer-deps --package-lock-only

im not really sure what the issue is at this point, or why we'd suddenly have "minor lock discrepancies"

[DaSchTour]

I have experience the same with 11.6.1
My renovate MRs are broken since mid September and I blamed it on renovate not working properly.

[romg974]

Same issue with npm ci and 11.6.2. Our solution was to revert to 11.6.1 until this is fixed. I have the feeling this is linked to #8593

[BarneyPowell]

FWIW We're seeing the same thing, in addition to other issues with 11.6.2, such as jest throwing an Unable to find jest-util error which I fixed by rolling back to 11.6.1. Unsure if they are related - I'll try and create a repo to reproduce the issue.

Our issue emerged due to an upstream docker image automatically installing latest npm, which we've now fixed @ 11.6.1.