JavaScript track: npm install can resolve an incompatible @langchain/core, even though the committed lockfile is fine

Summary

package.json (both starter-project and solution) pins:
​json "@langchain/core": "1.1.39", "@langchain/langgraph": "1.2.8", ​

The committed package-lock.json resolves @langchain/langgraph-checkpoint (a transitive dependency of @langchain/langgraph) to 1.0.1, which is compatible with @langchain/core@1.1.39. So the lockfile itself is internally consistent.

The problem: the exercises instruct learners to run npm install, not npm ci. npm install can re-resolve transitive dependencies against whatever's currently newest on the npm registry rather than strictly honoring the lockfile. @langchain/langgraph-checkpoint has since published newer versions (currently 1.1.3) that require @langchain/core: ^1.1.48 — incompatible with the exact 1.1.39 pin. A fresh npm install today resolves to this newer, incompatible version.

Effect

​ Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './utils/uuid' is not defined by "exports" in .../node_modules/@langchain/core/package.json imported from .../@langchain/langgraph/node_modules/@langchain/langgraph-checkpoint/dist/id.js ​
thrown immediately on npx tsx src/basicAgent.ts (or any entry point importing @langchain/langgraph), since @langchain/core@1.1.39 doesn't yet expose the ./utils/uuid export subpath that the newer langgraph-checkpoint@1.1.3 needs.

Suggested fix

Either:

1. Bump the pinned @langchain/core version in package.json to something satisfying ^1.1.48 (e.g. 1.1.49 or later), removing the fragility of the exact pin against a moving transitive dependency, or
2. Have learners run npm ci instead of npm install in the exercise instructions, so the exact working dependency tree from the committed lockfile is used rather than a fresh, potentially-drifted resolution (tradeoff: learners then don't get any newer patch versions of pinned packages).

Option 1 is more robust long-term, since this kind of drift will keep recurring as the npm ecosystem publishes new versions over time, regardless of the lockfile.

Environment

Reproduced on a personal SAP AI Core tenant, JavaScript/TypeScript track, npm install run fresh in starter-project/ (not npm ci), Node.js v24.18.0.

Comienza con package.json tanto en starter-project como en solution, el package-lock.json confirmado y las instrucciones del ejercicio para la instalación de dependencias. Reproduce el problema con un npm install nuevo en starter-project y, después, ejecuta npx tsx src/basicAgent.ts para confirmar el fallo. La tarea estará completada cuando ambas configuraciones del ejercicio utilicen un árbol de dependencias compatible y el punto de entrada se ejecute sin el package export error.