JavaScript track: npm install can resolve an incompatible @langchain/core, even though the committed lockfile is fine

Summary

package.json (both starter-project and solution) pins:
​json "@langchain/core": "1.1.39", "@langchain/langgraph": "1.2.8", ​

The committed package-lock.json resolves @langchain/langgraph-checkpoint (a transitive dependency of @langchain/langgraph) to 1.0.1, which is compatible with @langchain/core@1.1.39. So the lockfile itself is internally consistent.

The problem: the exercises instruct learners to run npm install, not npm ci. npm install can re-resolve transitive dependencies against whatever's currently newest on the npm registry rather than strictly honoring the lockfile. @langchain/langgraph-checkpoint has since published newer versions (currently 1.1.3) that require @langchain/core: ^1.1.48 — incompatible with the exact 1.1.39 pin. A fresh npm install today resolves to this newer, incompatible version.

Effect

​ Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './utils/uuid' is not defined by "exports" in .../node_modules/@langchain/core/package.json imported from .../@langchain/langgraph/node_modules/@langchain/langgraph-checkpoint/dist/id.js ​
thrown immediately on npx tsx src/basicAgent.ts (or any entry point importing @langchain/langgraph), since @langchain/core@1.1.39 doesn't yet expose the ./utils/uuid export subpath that the newer langgraph-checkpoint@1.1.3 needs.

Suggested fix

Either:

1. Bump the pinned @langchain/core version in package.json to something satisfying ^1.1.48 (e.g. 1.1.49 or later), removing the fragility of the exact pin against a moving transitive dependency, or
2. Have learners run npm ci instead of npm install in the exercise instructions, so the exact working dependency tree from the committed lockfile is used rather than a fresh, potentially-drifted resolution (tradeoff: learners then don't get any newer patch versions of pinned packages).

Option 1 is more robust long-term, since this kind of drift will keep recurring as the npm ecosystem publishes new versions over time, regardless of the lockfile.

Environment

Reproduced on a personal SAP AI Core tenant, JavaScript/TypeScript track, npm install run fresh in starter-project/ (not npm ci), Node.js v24.18.0.

starter-project と solution の両方にある package.json、コミット済みの package-lock.json、依存関係のインストールに関する演習の手順から始めます。starter-project で新しい npm install を実行して再現し、その後 npx tsx src/basicAgent.ts を実行して失敗を確認します。両方の演習セットアップが互換性のある依存関係ツリーを使用し、エントリーポイントが package export error なしで実行されれば完了です。