Skip to content

[BUG] overrides cause lock file to be out of sync, since 8.6 #4684

Description

@jklingen

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

npm overrides that work fine with npm 8.5.5, are causing an error during npm ci as of npm 8.6:

npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: trim-newlines@1.0.0 from lock file

After running npm install again (as suggested by the error message) npm ci is working again, but the transient trim-newlines dependency version is no longer overridden in package-lock.json.

Expected Behavior

npm install with overrides configuration should produce a package-lock.json that can be processed by npm ci and contains overridden versions.

Steps To Reproduce

On a local development machine, create a blank project with defaults and add a dependency with vulnerable transient dependency:

mkdir npm-overrides-issue
cd npm-overrides-issue
npm init
npm i svg2sprite-cli

-> 3 high severity vulnerabilities

add overrides configuration to mitigate transient vulnerability

  "overrides": {
    "trim-newlines": "^3.0.1"
  }

then

npm i
npm ci

-> still 3 high severity vulnerabilities, ci still works

force update of package-lock.json

rm -rf package-lock.json node_modules
npm i
npm ci

-> found 0 vulnerabilities, ci fails with the following error

npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: trim-newlines@1.0.0 from lock file

in order to check that it actually works with previous npm versions:

npm i -g npm@8.5.5
rm -rf package-lock.json node_modules
npm i
npm ci

-> found 0 vulnerabilities, ci works as expected

Environment

  • npm: 8.6.0
  • Node.js: v16.14.0
  • OS Name: MacOS
  • System Model Name: MacBook Pro 2021
  • npm config:
; "user" config from /Users/redacted/.npmrc

; redacted: custom registry configuration for internal dependencies, not related

; node bin location = /Users/redacted/.nvm/versions/node/v16.14.0/bin/node
; cwd = /Users/redacted/dev/npm-overrides-issue
; HOME = /Users/redacted
; Run `npm config ls -l` to show all defaults.
  • package.json
{
  "name": "npm-overrides-issue",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "svg2sprite-cli": "^2.0.1"
  },
  "overrides": {
    "trim-newlines": "^3.0.1"
  }
}

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Triageneeds review for next stepsRelease 8.xwork is associated with a specific npm 8 release

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions