npm ci fails intermittently due to missing lockfile shadow entries - #1143
Closed
alexmontesg wants to merge 3 commits into
Closed
npm ci fails intermittently due to missing lockfile shadow entries#1143alexmontesg wants to merge 3 commits into
alexmontesg wants to merge 3 commits into
Conversation
npm ci intermittently fails with 'Missing: @emnapi/core@1.11.2 from lock file' because @oxc-resolver/binding-wasm32-wasi pins an exact @emnapi/core@1.11.2 and @emnapi/runtime@1.11.2, but no nested shadow entry existed to satisfy it (top-level @emnapi/* resolves to 1.4.5 for unrelated packages). These entries were dropped by an automated release commit (adfbb4c) and never restored. Restored verbatim from the last known-good lockfile (ce6c215). Pure addition, no other resolved versions changed. Also hardens the release script that caused the original regression: version:development previously ended with a plain 'npm install', which is free to re-resolve and rewrite the lockfile tree. It now runs 'npm ci' first to validate the existing tree, then constrains the version-bump write to 'npm install --package-lock-only'. A new 'npm ci --dry-run' guard step in the release workflow fails the release job loudly if a future regeneration breaks the lockfile again, instead of silently pushing a broken lockfile to main. Closes #1142
Node 24.11.1 (pinned in code/.tool-versions) already bundles npm 11.6.2, satisfying the >=11.5.1 requirement for trusted publishing. Self-upgrading npm via 'npm install -g npm@^11.5.1' introduced an untracked npm version drift, which is what silently dropped lockfile shadow entries in commit adfbb4c. Removed the guard step added earlier for the same reason; no longer needed once the release job consistently uses the asdf-managed npm.
…pment adfbb4c (the commit that dropped the @emnapi shadow entries) was produced by the 'Release / Commit and Tag' step, which runs version:release — not version:development (that only runs later, for the next-development-iteration commit). Move the npm ci-then-install guard to the script that actually caused the regression.
|
Contributor
Author
|
Closing this issue, we found a documented issue on nx: nx release: please update your lock file with npm install before continuing. We will be skiping a resolution for now. A possible fix would be to clean install everything on the release job (rm -rf node_modules && rm package-lock.json && npm install) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1142
What
@emnapi/core@1.11.2,@emnapi/runtime@1.11.2) required to satisfy@oxc-resolver/binding-wasm32-wasi's exact pins. Pure addition, verified withnpm ci.version:development(release script) to stop using a plainnpm install, which is what silently dropped these entries in the first place (commit adfbb4c).npm ci --dry-run" guard step to the release workflow so any future lockfile regression fails the release job loudly instead of landing onmain` unnoticed.Verification
npm cisucceeds cleanly on this branch (previously failed withMissing: @emnapi/core@1.11.2 from lock file).