[BUG] `npm install` installs an invalid tree (as validated by `npm ci`)

[billyjanitsch]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

See the two commits in this repo.

The first commit is the result of running:

> npm install @pmmmwh/react-refresh-webpack-plugin@0.5.9 read-pkg-up@7.0.1
added 135 packages in 6s

This command exits without error, and correctly installs to node_modules/ and package-lock.json. However, the resulting tree is invalid, according to npm ci:

❯ npm ci
npm ERR! code EUSAGE
npm ERR! 
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.

The second commit is the result of running npm install again. This updates the package lock to a valid tree, and npm ci now completes successfully.

Expected Behavior

It shouldn't be necessary to run npm install twice to get a valid tree.

Steps To Reproduce

See current behavior for a minimal repro repository.

Environment

• npm: 9.1.1
• Node.js: 18.12.0
• OS Name: macOS
• System Model Name: MacBook Pro (16-inch, 2019)
• npm config: none

[wraithgar]

@pmmmwh/react-refresh-webpack-plugin is asking for a peerDependency of type-fest that is incompatible with what read-pkg-up is asking for as a dependency. npm is hoisting what read-pkg-up wants, colliding w/ what @pmmmwh/react-refresh-webpack-plugin wants as its peer dep

~/D/n/s/file $ npm view @pmmmwh/react-refresh-webpack-plugin@0.5.9 peerDependencies["type-fest"]
>=0.17.0 <4.0.0
~/D/n/s/file $ npm view read-pkg-up@7.0.1 dependencies["type-fest"]
^0.8.1
~/D/n/s/file $ npm query '#type-fest'|json -a _id location from
type-fest@0.6.0 node_modules/read-pkg/node_modules/type-fest [
  "node_modules/read-pkg"
]
type-fest@0.8.1 node_modules/type-fest [
  "node_modules/read-pkg-up",
  "node_modules/@pmmmwh/react-refresh-webpack-plugin"
]

[Saibamen]

Tested with #8981:

npm ci: OK (both from 11.10.0 and PR #8981 (448db52))

npm ls (the same output for both versions):

npm-install-bug@1.0.0 C:\DEV\npm_test\5854
+-- @pmmmwh/react-refresh-webpack-plugin@0.5.17
+-- read-pkg-up@7.0.1
`-- type-fest@4.41.0 extraneous

git diff between package-lock.json files from the first npm install - NPM 11.10.0 vs NPM from PR #8981 (448db52):

diff --git a/package-lock.json b/package-lock.json
index 25d6a7c..bf64132 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1074,6 +1074,15 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/read-pkg-up/node_modules/type-fest": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
+      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/read-pkg/node_modules/type-fest": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.6.0.tgz",
@@ -1336,12 +1345,16 @@
       }
     },
     "node_modules/type-fest": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
-      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "version": "4.41.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
+      "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
+      "extraneous": true,
       "license": "(MIT OR CC0-1.0)",
       "engines": {
-        "node": ">=8"
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/undici-types": {

[Saibamen]

Fixed in NPM 11.10.1. Please update your NPM:
npm install -g npm@latest