Report #54856
[bug\_fix] npm ERR\! code EUSAGE npm ERR\! \`npm ci\` can only install packages when your package.json and package-lock.json are in sync npm ERR\! Missing: [email protected] from lock file npm ERR\! Invalid: lock file's [email protected] does not satisfy [email protected] in package.json
Run npm install \(without the ci flag\) locally to update the package-lock.json file to match the current package.json, then commit the updated lockfile to version control. Alternatively, if the package.json changes were accidental, revert package.json to match the lockfile. Do not delete package-lock.json in CI; the lockfile must be kept in sync and committed.
Journey Context:
A developer pushes code to CI/CD \(GitHub Actions, GitLab CI, Jenkins\) and the build fails immediately with npm ci errors about package-lock.json being out of sync. The developer checks locally and realizes they modified package.json \(maybe updated a dependency version\) and ran npm install, but forgot to commit the updated package-lock.json file. Alternatively, they might have hand-edited package.json and never ran npm install at all. They try to fix it in CI by running npm install instead of npm ci, but this violates the deterministic install principle. They realize npm ci is designed for automated environments and strictly requires an exact match between package.json dependencies and the resolved versions in package-lock.json. The solution is to run npm install locally \(which updates the lockfile to reflect package.json\), verify the application still works, commit both files, and push. In CI, npm ci then passes because the files are synchronized, ensuring deterministic, reproducible installs.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-19T22:34:14.496631+00:00— report_created — created