[BUG] upgrading to lockfile v2 creates an incomplete lockfile
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Running npm install --package-lock-only on a v1 lockfile creates a v2 package-lock.json that is incomplete.
Subsequently running npm ci --package-lock-only complains that the package.json and package-lock.json are not in sync
Complete output
npm ERR! code EUSAGE
npm ERR!
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Invalid: lock file's @babel/core@7.9.0 does not satisfy @babel/core@7.19.6
npm ERR! Missing: @ampproject/remapping@2.2.0 from lock file
npm ERR! Invalid: lock file's @babel/code-frame@7.14.5 does not satisfy @babel/code-frame@7.18.6
npm ERR! Invalid: lock file's @babel/generator@7.15.4 does not satisfy @babel/generator@7.19.6
npm ERR! Invalid: lock file's @babel/helper-compilation-targets@7.15.4 does not satisfy @babel/helper-compilation-targets@7.19.3
npm ERR! Invalid: lock file's @babel/helper-module-transforms@7.15.4 does not satisfy @babel/helper-module-transforms@7.19.6
npm ERR! Invalid: lock file's @babel/helpers@7.15.4 does not satisfy @babel/helpers@7.19.4
npm ERR! Invalid: lock file's @babel/parser@7.15.6 does not satisfy @babel/parser@7.19.6
npm ERR! Invalid: lock file's @babel/template@7.15.4 does not satisfy @babel/template@7.18.10
npm ERR! Invalid: lock file's @babel/traverse@7.15.4 does not satisfy @babel/traverse@7.19.6
npm ERR! Invalid: lock file's @babel/types@7.15.6 does not satisfy @babel/types@7.19.4
npm ERR! Invalid: lock file's json5@2.2.0 does not satisfy json5@2.2.1
npm ERR! Missing: semver@6.3.0 from lock file
npm ERR! Missing: @jridgewell/gen-mapping@0.1.1 from lock file
npm ERR! Missing: @jridgewell/trace-mapping@0.3.17 from lock file
npm ERR! Invalid: lock file's @babel/highlight@7.14.5 does not satisfy @babel/highlight@7.18.6
npm ERR! Missing: @jridgewell/gen-mapping@0.3.2 from lock file
npm ERR! Invalid: lock file's @babel/compat-data@7.15.0 does not satisfy @babel/compat-data@7.19.4
npm ERR! Invalid: lock file's @babel/helper-validator-option@7.14.5 does not satisfy @babel/helper-validator-option@7.18.6
npm ERR! Invalid: lock file's browserslist@4.17.0 does not satisfy browserslist@4.21.4
npm ERR! Missing: @babel/helper-environment-visitor@7.18.9 from lock file
npm ERR! Invalid: lock file's @babel/helper-module-imports@7.15.4 does not satisfy @babel/helper-module-imports@7.18.6
npm ERR! Invalid: lock file's @babel/helper-simple-access@7.15.4 does not satisfy @babel/helper-simple-access@7.19.4
npm ERR! Invalid: lock file's @babel/helper-split-export-declaration@7.15.4 does not satisfy @babel/helper-split-export-declaration@7.18.6
npm ERR! Invalid: lock file's @babel/helper-validator-identifier@7.14.9 does not satisfy @babel/helper-validator-identifier@7.19.1
npm ERR! Invalid: lock file's @babel/helper-function-name@7.15.4 does not satisfy @babel/helper-function-name@7.19.0
npm ERR! Invalid: lock file's @babel/helper-hoist-variables@7.15.4 does not satisfy @babel/helper-hoist-variables@7.18.6
npm ERR! Missing: @babel/helper-string-parser@7.19.4 from lock file
npm ERR! Missing: @jridgewell/set-array@1.1.2 from lock file
npm ERR! Missing: @jridgewell/sourcemap-codec@1.4.14 from lock file
npm ERR! Missing: @jridgewell/resolve-uri@3.1.0 from lock file
npm ERR! Missing: react@17.0.2 from lock file
npm ERR! Missing: react-dom@17.0.2 from lock file
npm ERR! Missing: @babel/core@7.9.0 from lock file
npm ERR! Missing: jquery@3.6.1 from lock file
npm ERR! Missing: popper.js@1.16.1 from lock file
npm ERR! Invalid: lock file's caniuse-lite@1.0.30001257 does not satisfy caniuse-lite@1.0.30001423
npm ERR! Invalid: lock file's electron-to-chromium@1.3.838 does not satisfy electron-to-chromium@1.4.284
npm ERR! Missing: node-releases@2.0.6 from lock file
npm ERR! Missing: update-browserslist-db@1.0.10 from lock file
npm ERR! Missing: scheduler@0.20.2 from lock file
npm ERR! Missing: @babel/core@7.9.0 from lock file
npm ERR! Missing: typescript@4.8.4 from lock file
npm ERR! Missing: picocolors@1.0.0 from lock file
npm ERR! Missing: debug@4.3.4 from lock file
npm ERR! Missing: json5@2.2.1 from lock file
npm ERR! Missing: source-map@0.5.7 from lock file
npm ERR! Missing: ms@2.1.2 from lock file
npm ERR! Missing: bindings@1.5.0 from lock file
npm ERR! Missing: file-uri-to-path@1.0.0 from lock file
npm ERR! Missing: debug@4.3.4 from lock file
npm ERR! Missing: json5@2.2.1 from lock file
npm ERR! Missing: semver@5.7.1 from lock file
npm ERR! Missing: source-map@0.5.7 from lock file
npm ERR! Missing: ms@2.1.2 from lock file
npm ERR!
npm ERR! Clean install a project
npm ERR!
npm ERR! Usage:
npm ERR! npm ci
npm ERR!
npm ERR! Options:
npm ERR! [-S|--save|--no-save|--save-prod|--save-dev|--save-optional|--save-peer|--save-bundle]
npm ERR! [-E|--save-exact] [-g|--global] [--global-style] [--legacy-bundling]
npm ERR! [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm ERR! [--strict-peer-deps] [--no-package-lock] [--foreground-scripts]
npm ERR! [--ignore-scripts] [--no-audit] [--no-bin-links] [--no-fund] [--dry-run]
npm ERR! [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm ERR! [-ws|--workspaces] [--include-workspace-root] [--install-links]
npm ERR!
npm ERR! aliases: clean-install, ic, install-clean, isntall-clean
npm ERR!
npm ERR! Run "npm help ci" for more info
npm ERR! A complete log of this run can be found in:
npm ERR! /home/abex/.npm/_logs/2022-10-24T04_53_55_132Z-debug-0.log
A Subsequent run of npm install --package-lock-only then updates and re-locks all of the projects dependencies.
Everything is with --package-lock-only because a normal install fails on node>14 because of a dependency on node-sass that does not compile against newer versions of node.
Using npm@6.14.17, which does not write v2 lockfiles, can npm install this project without altering the lockfile and works correctly.
Expected Behavior
npm install --package-lock-only should upgrade the lockfile to v2, producing a lockfile that is logically equivalent to the previous v1 lockfile, where a npm ci completes successfully and subsequent npm installs do not alter the locked dependencies
Steps To Reproduce
- Checkout runelite/runelite.net@55996fb355618cd751bf2eb2ebb00e5d68104789
npm install --package-lock-only
Notice it has updated to a v2 lockfilenpm ci --package-lock-only
Notice it failsnpm install --package-lock-only
Notice it has now updated dependencies to new versions in the lockfile
Environment
- npm: 8.19.2
- Node.js: v18.11.0
- OS Name: Arch Linux
- npm config:
; "env" config from environment
prefix = "/home/abex/.node_modules"
; node bin location = /usr/bin/node
; node version = v18.11.0
; npm local prefix = /home/abex/code/runelite.net
; npm version = 8.19.2
; cwd = /home/abex/code/runelite.net
; HOME = /home/abex
; Run `npm config ls -l` to show all defaults.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report from runelite/runelite.net@55996fb355618cd751bf2eb2ebb00e5d68104789 using npm install --package-lock-only and npm ci --package-lock-only, then compare package-lock.json before and after conversion. Trace the npm lockfile generation path responsible for upgrading v1 to v2. Done means the first conversion preserves the locked dependencies and the subsequent npm ci completes without changing them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100