npm install removes resolved and integrity properties from package-lock.json if installed from cache #4263

SymbioticKilla · 2022-01-19T17:27:44Z

Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

If you run npm install with existing package cache inside "node_modules" it creates packages-lock.json without "resolved" and "integrity" properties.

Expected Behavior

"resolved" and "integrity" properties should stay remain after npm install using cache from "node_modules" folder

Steps To Reproduce

1.) Run npm install
2.) package-lock.json is created
3.) node modules are cached inside the project folder under "node_modules" folder
4.) delete package-lock.json and delete one package form "node_modules" folder
5.) Run npm install
6.) package-lock.json is created, but "resolved" and "integrity" properties are removed from each package descriptions inside package-lock.json

Environment

npm: 8.1.2
Node.js: 16.3.2
OS Name: Windows 10
System Model Name:
npm config:

; copy and paste output from `npm config ls` here

giovannipds · 2022-02-24T22:42:51Z

In my case, it removes the resolved entry for a company's remote repository, causing the CI pipeline to fail.

npm 8.1.3
node v16.3.0
Mac OS

ljharb · 2022-02-25T00:04:51Z

@giovannipds what about with npm v8.5.2?

giovannipds · 2022-02-25T22:31:00Z

@ljharb thanks for interacting. In my case, the issue was in my repository config, it was misconfigured, that's why my resolveds were being removed. Probably not related to what this ticket is about. What fixed for me:

npm config set registry #YOUR_COMPANY_REGISTRY_URL

bring back lost `resolved` and `integrity` properties see: npm/cli#4263 License: (Apache-2.0 AND MIT) Signed-off-by: Oli Evans <[email protected]>

vmasek · 2022-07-03T13:50:46Z

I managed to get proper package-lock.json (with integrity and resolve fields) after:

cleaning the npm cache npm cache clean -f
removing node_modules in project folder
removing the package-lock.json file
running npm install in now "clean" project folder

aarowman · 2023-01-25T16:05:52Z

Just ran into this issue on npm 8.19.2 with node v18.12.1.

Cleared the cache and re-ran npm install (slow), then it was ok

cdpark0530 · 2023-03-19T09:06:49Z

I encountered the same issue with nodejs 16.19.1 and npm 8.19.3

daksh-sagar · 2023-04-14T12:29:44Z

encountered the same issue with node 14.18.0 and npm 8.19.3

sorgloomer · 2023-04-26T11:00:58Z

Happened on npm v9.5.0 too. vmaseks workaround worked.

kfayelun · 2023-07-05T10:06:00Z

We also get this. Repeatedly. And it breaks our CI. Started after we updated to new versions of node and npm recently I think, but I see others get it on older versions as well. I'm not 100% if that is what cased it, as we have refactored a lot of stuff lately.
Current versions:
Node: 18.16.0
npm: 9.6.7
old versions:
Node: 16.5.1
npm: not sure unfortunately, but v8.x.x something

Only workaround is @vmasek workaround above. Would love to not have to delete package-lock.json the whole time, any idea whats causing this or if/when it will be fixed?

rbell-mfj · 2023-08-10T20:11:44Z

For those who dislike the idea of unlocking and potentially version-bumping a ton of dependencies by deleting package-lock, here's a variant of the workaround above that seems to have worked for us:

Delete node_modules folder
Restore package-lock.json from a recent commit prior to the undesired property removal (but keep the existing package.json version)
Run npm install

This should preserve the locked versions of any packages that were already installed prior to the corruption of package-lock, while ensuring anything newer based on package.json also gets installed/updated.

Rapol · 2023-09-07T16:00:07Z

I had this happened to me during npm solving merge conflicts with npm-merge-driver. Similarly to @rbell-mfj, I restored package-lock.json before merge conflict resolution, applied the updates manually, integrity and resolved were kept.

LendaVadym · 2023-10-12T11:25:27Z

I faced the same problem with node 18.12.1 and npm 8.19.2
Had to do actions proposed by vmasek to resolve the problem.

felschr · 2023-10-16T15:03:26Z

While this problem persists, npm-lockfile-fix provides an easy way to fix lock files without having to delete & regenerate them. It's less problematic since it doesn't cause any dependency updates.

Also it seems that these are duplicates or related issues: #4460 #6301

Caused by an issue of command npm install (see npm/cli#4263). Introduced by commit a841343

* chore: add sitemap Google search console suggested we do this? No clue if it's a good idea or worth doing. * Include sitemap in layout.astro * chore: run npm upgrade Attempting to appease the npm gods. * workaround npm/cli#4263 * Run npm format

Caused by an issue of command npm install (see npm/cli#4263). Introduced by commit a841343

CommanderOfCode · 2024-02-23T19:13:59Z

I wonder if the npm team will ever pick this issue up? It's still happening.

GMartigny · 2024-03-21T10:51:39Z

Has this issue today, solved it with running npm cache clear --force (not sure if this was useful) and npm update.

klausbadelt · 2024-03-22T12:08:26Z

.. solved it with ... npm update.

npm update, or deleting package-lock.json then npm install, IMHO defeats the purpose of package-lock.json and can cause issues downstream (different dependency versions, failing tests, failing deploys, bugs...).
We have package-lock.json change 'randomly' after npm install from different developers. All on the same (at least major) version, causing CI delays (busted cache).
So, our problem is similar albeit not related to deleting package-lock.json (which we do not recommend every anyway): Subsequent npm installs on different machines change package-lock.json "resolved" and "integrity" entries. Would love to see this solved.

sorgloomer · 2024-03-22T16:51:24Z

.. solved it with ... npm update.

npm update, or deleting package-lock.json then npm install, IMHO defeats the purpose of package-lock.json and can cause issues downstream (different dependency versions, failing tests, failing deploys, bugs...). We have package-lock.json change 'randomly' after npm install from different developers. All on the same (at least major) version, causing CI delays (busted cache). So, our problem is similar albeit not related to deleting package-lock.json (which we do not recommend every anyway): Subsequent npm installs on different machines change package-lock.json "resolved" and "integrity" entries. Would love to see this solved.

This might be a dumb suggestion, but couldn't you just ask your developers not to change the package-lock? For example, tell them to use npm ci on their dev machines instead of npm install unless they are intentionally updating packages.

When building Packit with Nix (and other sandboxed build systems), these fields are used to prefetch the dependencies. For some reason they are missing from our file for all but one dependency. There seems to be some npm bug that causes these fields to be removed under certain conditions (npm/cli#4263, npm/cli#6301). Deleting the lockfile and running `npm install` again produces a new file that has the missing fields. However in doing so all the dependencies are updated, which I'd rather not right now. Instead I used the script at https://github.com/jeslie0/npm-lockfile to add the fields without changing the version numbers.

Release notes: https://docs.goauthentik.io/docs/releases/2024.8 Still includes the same hacky workaround for one of the dependencies that was introduced in the 2024.6.1 update. See components/docs.nix for more information. Also, as upstream package-lock.json files do not include source hashes and urls for a lot of dependencies, building authentik from source is only possible after they've been resolved. This makes it kind of a gamble to try and reproduce a build with the same set of dependencies that the devs use. This is why the two relevant lock files are vendored here now. See upstream issues for more information: - goauthentik/authentik#6180 - goauthentik/authentik#11169 and the npm issue for the underlying reason: npm/cli#4263 Flake lock file updates: • Updated input 'flake-parts': 'github:hercules-ci/flake-parts/8471fe90ad337a8074e957b69ca4d0089218391d' (2024-08-01) → 'github:hercules-ci/flake-parts/567b938d64d4b4112ee253b9274472dc3a346eb6' (2024-09-01) • Updated input 'flake-parts/nixpkgs-lib': 'https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz?narHash=sha256-uFf2QeW7eAHlYXuDktm9c25OxOyCoUOQmh5SZ9amE5Q%3D' (2024-08-01) → 'https://github.com/NixOS/nixpkgs/archive/356624c12086a18f2ea2825fed34523d60ccc4e3.tar.gz?narHash=sha256-Ss8QWLXdr2JCBPcYChJhz4xJm%2Bh/xjl4G0c0XlP6a74%3D' (2024-09-01) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/c374d94f1536013ca8e92341b540eba4c22f9c62' (2024-08-21) → 'github:NixOS/nixpkgs/574d1eac1c200690e27b8eb4e24887f8df7ac27c' (2024-09-06) • Updated input 'poetry2nix': 'github:nix-community/poetry2nix/884b66152b0c625b8220b570a31dc7acc36749a3' (2024-08-21) → 'github:nix-community/poetry2nix/a313fd7169ae43ecd1a2ea2f1e4899fe3edba4d2' (2024-09-05)

klausbadelt · 2024-09-08T02:15:53Z

This might be a dumb suggestion, but couldn't you just ask your developers not to change the package-lock? For example, tell them to use npm ci on their dev machines instead of npm install unless they are intentionally updating packages.

npm ci amongst other things deletes all node_modules folders. This would slow us down quite a bit. I also think original intent was CI, not local dev.

## Which problem is this PR solving? - Add missing integrity checks to package-lock.json ## Description of the changes - I noticed some lockfile entries didn't have the `resolved` and `integrity` field set. This PR fixed that. - I think it's related to this npm issue: npm/cli#4263 ## How was this change tested? - no functional change ## Checklist - [X] I have read https://github.com/jaegertracing/jaeger/blob/master/CONTRIBUTING_GUIDELINES.md - [X] I have signed all commits - [ ] I have added unit tests for the new functionality - [ ] I have run lint and test steps successfully - for `jaeger`: `make lint test` - for `jaeger-ui`: `yarn lint` and `yarn test` Signed-off-by: Andreas Gerstmayr <[email protected]>

SymbioticKilla added Bug thing that needs fixing Needs Triage needs review for next steps Release 8.x work is associated with a specific npm 8 release labels Jan 19, 2022

jacobduncan00 mentioned this issue Mar 7, 2022

SIWPA-8: API - Modify Listing Routes jventura1738/InternshipPortal#11

Merged

olizilla added a commit to web3-storage/web3.storage that referenced this issue Apr 19, 2022

chore: fix package-lock.json

13cb9e9

bring back lost `resolved` and `integrity` properties see: npm/cli#4263 License: (Apache-2.0 AND MIT) Signed-off-by: Oli Evans <[email protected]>

adamjmcgrath mentioned this issue Jan 18, 2023

Merge master into beta, update to latest auth0-spa-js version auth0/auth0-react#473

Merged

3 tasks

jeslie0 mentioned this issue Apr 13, 2023

Missing "resolved" and "integrity" from lock file lydell/elm-watch#59

Closed

jeslie0 mentioned this issue Apr 25, 2023

Is there a bug report with npm to fix this? jeslie0/npm-lockfile-fix#1

Open

hlolli mentioned this issue Jun 1, 2023

Feature request: support for npm lockfile version 3 serokell/nix-npm-buildpackage#76

Open

WilliButz mentioned this issue Jul 7, 2023

Please provide package-lock.json with fully resolved dependencies again goauthentik/authentik#6180

Closed

hatton mentioned this issue Aug 19, 2023

Resolving a Latex Rendering Problem sillsdev/docu-notion#71

Closed

relu91 mentioned this issue Sep 7, 2023

update opcua modules - remove unnecessary data transformation eclipse-thingweb/node-wot#1072

Closed

robertsLando mentioned this issue Dec 4, 2023

Support for reproducible builds zwave-js/zwave-js-ui#3466

Closed

lenkan mentioned this issue Dec 4, 2023

Using @nobles/hashes WebOfTrust/signify-ts#162

Closed

Desplandis added a commit to Desplandis/itowns that referenced this issue Dec 5, 2023

fix(package-lock.json): Restore resolved and integrity properties

92758c9

Caused by an issue of command npm install (see npm/cli#4263). Introduced by commit a841343

Desplandis mentioned this issue Dec 5, 2023

fix(package-lock): Restore resolved and integrity properties iTowns/itowns#2233

Merged

Desplandis added a commit to iTowns/itowns that referenced this issue Dec 5, 2023

fix(package-lock.json): Restore resolved and integrity properties

6737c93

Caused by an issue of command npm install (see npm/cli#4263). Introduced by commit a841343

kira-bruneau mentioned this issue Dec 16, 2023

Add missing resolved & integrity fields in npm-shrinkwrap.json gadget-inc/ggt#1068

Merged

kira-bruneau mentioned this issue Dec 28, 2023

Add missing resolved & integrity fields to package-lock.json anyproto/anytype-ts#430

Merged

16 tasks

prabhu mentioned this issue Jan 2, 2024

[npm] Track packages without integrity CycloneDX/cdxgen#795

Closed

markostreich mentioned this issue Jan 18, 2024

#1202 upgrade @muenchen/vjsf version it-at-m/digiwf-core#1233

Merged

8 tasks

eseidel added a commit to shorebirdtech/website that referenced this issue Jan 25, 2024

workaround npm/cli#4263

d146f81

AnthonyGlt pushed a commit to AnthonyGlt/itowns that referenced this issue Feb 22, 2024

fix(package-lock.json): Restore resolved and integrity properties

60ed790

Caused by an issue of command npm install (see npm/cli#4263). Introduced by commit a841343

natsukium mentioned this issue May 4, 2024

Updated package-lock.json luizcorreia/spectral-language-server#15

Merged

anselmbradford mentioned this issue May 14, 2024

USWDS - Dependencies: Update eslint, prettier, stylelint and dependencies uswds/uswds#5782

Merged

xzfc mentioned this issue Jun 15, 2024

fix: add missing fields to package-lock.json and bump version qdrant/qdrant-web-ui#188

Merged

pluiedev mentioned this issue Jun 20, 2024

package-lock.json is malformed (missing resolve and integrity fields) faressoft/terminalizer#243

Open

slavistan mentioned this issue Jun 24, 2024

Fix/bump vulnerable dev subdependency of iql nmshd/runtime#166

Closed

taylormadore mentioned this issue Aug 12, 2024

Not fetching all NPM dependencies containerbuildsystem/cachi2#595

Closed

plietar mentioned this issue Aug 23, 2024

Add missing integrity and resolved fields to package-lock.json. mrc-ide/packit#111

Merged

andreasgerstmayr mentioned this issue Oct 14, 2024

Add missing integrity checks to package-lock.json jaegertracing/jaeger-ui#2478

Merged

4 tasks

jlp-craigmorten mentioned this issue Nov 20, 2024

chore: backport fork changes to upstream ASOS/snyker#7

Merged

khassel mentioned this issue Dec 24, 2024

add support for fetch timeout control for node_helpers, fix timeouts on armv6l MagicMirrorOrg/MagicMirror#3660

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

npm install removes resolved and integrity properties from package-lock.json if installed from cache #4263

npm install removes resolved and integrity properties from package-lock.json if installed from cache #4263

SymbioticKilla commented Jan 19, 2022

giovannipds commented Feb 24, 2022 •

edited

Loading

ljharb commented Feb 25, 2022

giovannipds commented Feb 25, 2022

vmasek commented Jul 3, 2022 •

edited

Loading

aarowman commented Jan 25, 2023

cdpark0530 commented Mar 19, 2023

daksh-sagar commented Apr 14, 2023

sorgloomer commented Apr 26, 2023

kfayelun commented Jul 5, 2023

rbell-mfj commented Aug 10, 2023

Rapol commented Sep 7, 2023

LendaVadym commented Oct 12, 2023

felschr commented Oct 16, 2023

CommanderOfCode commented Feb 23, 2024 •

edited

Loading

GMartigny commented Mar 21, 2024

klausbadelt commented Mar 22, 2024

sorgloomer commented Mar 22, 2024

klausbadelt commented Sep 8, 2024

npm install removes resolved and integrity properties from package-lock.json if installed from cache #4263

npm install removes resolved and integrity properties from package-lock.json if installed from cache #4263

Comments

SymbioticKilla commented Jan 19, 2022

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

giovannipds commented Feb 24, 2022 • edited Loading

ljharb commented Feb 25, 2022

giovannipds commented Feb 25, 2022

vmasek commented Jul 3, 2022 • edited Loading

aarowman commented Jan 25, 2023

cdpark0530 commented Mar 19, 2023

daksh-sagar commented Apr 14, 2023

sorgloomer commented Apr 26, 2023

kfayelun commented Jul 5, 2023

rbell-mfj commented Aug 10, 2023

Rapol commented Sep 7, 2023

LendaVadym commented Oct 12, 2023

felschr commented Oct 16, 2023

CommanderOfCode commented Feb 23, 2024 • edited Loading

GMartigny commented Mar 21, 2024

klausbadelt commented Mar 22, 2024

sorgloomer commented Mar 22, 2024

klausbadelt commented Sep 8, 2024

giovannipds commented Feb 24, 2022 •

edited

Loading

vmasek commented Jul 3, 2022 •

edited

Loading

CommanderOfCode commented Feb 23, 2024 •

edited

Loading