npm ci fails after external release of [email protected]

[trentm]

As of recently, npm ci fails (output using node v22.12.0 (npm v10.9.0)):

% npm ci
npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Invalid: lock file's [email protected] does not satisfy [email protected]
npm error
npm error Clean install a project
npm error
npm error Usage:
npm error npm ci
npm error
npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
npm error [--no-bin-links] [--no-fund] [--dry-run]
npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm error [-ws|--workspaces] [--include-workspace-root] [--install-links]
npm error
npm error aliases: clean-install, ic, install-clean, isntall-clean
npm error
npm error Run "npm help ci" for more info
npm error A complete log of this run can be found in: /Users/trentm/.npm/_logs/2025-01-06T17_43_25_429Z-debug-0.log

"complete log" npm output

0 verbose cli /Users/trentm/.nvm/versions/node/v22.12.0/bin/node /Users/trentm/.nvm/versions/node/v22.12.0/bin/npm
1 info using [email protected]
2 info using [email protected]
3 silly config load:file:/Users/trentm/.nvm/versions/node/v22.12.0/lib/node_modules/npm/npmrc
4 silly config load:file:/Users/trentm/el/apm-agent-nodejs/.npmrc
5 silly config load:file:/Users/trentm/.npmrc
6 silly config load:file:/Users/trentm/.nvm/versions/node/v22.12.0/etc/npmrc
7 verbose title npm ci
8 verbose argv "ci"
9 verbose logfile logs-max:10 dir:/Users/trentm/.npm/_logs/2025-01-06T17_43_25_429Z-
10 verbose logfile /Users/trentm/.npm/_logs/2025-01-06T17_43_25_429Z-debug-0.log
11 silly logfile start cleaning logs, removing 1 files
12 silly packumentCache heap:4345298944 maxSize:1086324736 maxEntrySize:543162368
13 silly logfile done cleaning log files
14 silly idealTree buildDeps
15 silly fetch manifest process-warning@^4.0.0
16 silly packumentCache full:https://registry.npmjs.org/process-warning cache-miss
17 http fetch GET 200 https://registry.npmjs.org/process-warning 6ms (cache hit)
18 silly packumentCache full:https://registry.npmjs.org/process-warning set size:29667 disposed:false
19 silly placeDep ROOT [email protected] REPLACE for: [email protected] want: ^4.0.0
20 verbose stack Error: 
20 verbose stack `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
20 verbose stack
20 verbose stack Invalid: lock file's [email protected] does not satisfy [email protected]
20 verbose stack
20 verbose stack Clean install a project
20 verbose stack
20 verbose stack Usage:
20 verbose stack npm ci
20 verbose stack
20 verbose stack Options:
20 verbose stack [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
20 verbose stack [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
20 verbose stack [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
20 verbose stack [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
20 verbose stack [--no-bin-links] [--no-fund] [--dry-run]
20 verbose stack [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
20 verbose stack [-ws|--workspaces] [--include-workspace-root] [--install-links]
20 verbose stack
20 verbose stack aliases: clean-install, ic, install-clean, isntall-clean
20 verbose stack
20 verbose stack Run "npm help ci" for more info
20 verbose stack     at CI.usageError (/Users/trentm/.nvm/versions/node/v22.12.0/lib/node_modules/npm/lib/base-cmd.js:111:26)
20 verbose stack     at CI.exec (/Users/trentm/.nvm/versions/node/v22.12.0/lib/node_modules/npm/lib/commands/ci.js:70:18)
20 verbose stack     at async Npm.exec (/Users/trentm/.nvm/versions/node/v22.12.0/lib/node_modules/npm/lib/npm.js:207:9)
20 verbose stack     at async module.exports (/Users/trentm/.nvm/versions/node/v22.12.0/lib/node_modules/npm/lib/cli/entry.js:74:5)
21 error code EUSAGE
22 error
22 error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
22 error
22 error Invalid: lock file's [email protected] does not satisfy [email protected]
22 error
22 error Clean install a project
22 error
22 error Usage:
22 error npm ci
22 error
22 error Options:
22 error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
22 error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
22 error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
22 error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
22 error [--no-bin-links] [--no-fund] [--dry-run]
22 error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
22 error [-ws|--workspaces] [--include-workspace-root] [--install-links]
22 error
22 error aliases: clean-install, ic, install-clean, isntall-clean
22 error
22 error Run "npm help ci" for more info
23 verbose cwd /Users/trentm/el/apm-agent-nodejs
24 verbose os Darwin 24.2.0
25 verbose node v22.12.0
26 verbose npm  v10.9.0
27 verbose exit 1
28 verbose code 1
29 error A complete log of this run can be found in: /Users/trentm/.npm/_logs/2025-01-06T17_43_25_429Z-debug-0.log

AFAIK this shouldn't be possible: the repo had a package-lock.json that was working, sometime later that fails in determining the layout of node_modules/... (handled by npm's "arborist" library, IIUC).

This seems to be related to the recent release (3d ago) of [email protected].
The npm debug log output includes:

15 silly fetch manifest process-warning@^4.0.0
16 silly packumentCache full:https://registry.npmjs.org/process-warning cache-miss
17 http fetch GET 200 https://registry.npmjs.org/process-warning 6ms (cache hit)
18 silly packumentCache full:https://registry.npmjs.org/process-warning set size:29667 disposed:false
19 silly placeDep ROOT [email protected] REPLACE for: [email protected] want: ^4.0.0

I don't know npm's internals well enough to know what the placeDep ROOT [email protected] REPLACE is really about, nor why that leads to: Invalid: lock file's [email protected] does not satisfy [email protected].

Perhaps this is related to existing npm ls issues related to process-warning in our current package-lock file:

% npm ls --package-lock-only process-warning
[email protected] /Users/trentm/el/apm-agent-nodejs
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected] deduped invalid: "^4.0.0" from node_modules/fastify
│ └── [email protected] invalid: "^4.0.0" from node_modules/fastify
└─┬ [email protected]
  └── [email protected]

npm error code ELSPROBLEMS
npm error invalid: [email protected] /Users/trentm/el/apm-agent-nodejs/node_modules/fastify/node_modules/process-warning
npm error A complete log of this run can be found in: /Users/trentm/.npm/_logs/2025-01-06T17_48_45_164Z-debug-0.log

Note that npm ls --package-lock-only does not error out or log errors or warnings, so this isn't an easily discoverable state.