Dependency conflict: tinyglobby requires picomatch@^4.0.3 but picomatch@2.3.1 is installed.

[7hokerz]

[REQUIRED] Environment info

firebase-tools: 14.19.1

Platform: Windows 10 22H2, vscode, Next.js(v15.5.4)

[REQUIRED] Test case

1. npm update
2. npm ls picomatch
3. firebase deploy --only apphosting

[REQUIRED] Steps to reproduce

Follow the steps above in order.

And, these errors can be observed in step 2.

├─┬ firebase-tools@14.19.1
│ ├─┬ chokidar@3.6.0
│ │ ├─┬ anymatch@3.1.3
│ │ │ └── picomatch@2.3.1 deduped
│ │ └─┬ readdirp@3.6.0
│ │   └── picomatch@2.3.1 deduped
│ └─┬ superstatic@9.2.0
│   └─┬ re2@1.22.1
│     └─┬ node-gyp@11.4.2
│       └─┬ tinyglobby@0.2.15
│         ├─┬ fdir@6.5.0
│         │ └── picomatch@2.3.1 deduped invalid: "^4.0.3" from node_modules/tinyglobby, "^3 || ^4" from node_modules/tinyglobby/node_modules/fdir
│         └── picomatch@2.3.1 deduped invalid: "^4.0.3" from node_modules/tinyglobby
...
npm error code ELSPROBLEMS
npm error invalid: picomatch@2.3.1 D:\...\node_modules\picomatch

[REQUIRED] Expected behavior

The app is deployed normally without any package-related errors.

[REQUIRED] Actual behavior

There's a problem with deployment, and Cloud Build displays the logs for it.

npm error code EUSAGE
  | npm error
  | npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
  | npm error
  | npm error Missing: picomatch@4.0.3 from lock file

[aalej]

Hey @7hokerz, thanks for reporting this. At the moment, I can’t seem to reproduce the issue. If you are encountering an error running the deploy command on the Firebase CLI, could you please share the firebase-debug.log if it exists? If not, please rerun the command with --debug.

Also, the Cloud Build seems to be erroring out when trying to install the dependencies in your Next.js application. By any chance, could you provide your package.json and package-lock.json or steps on how you set up your Next.js project?

[7hokerz]

Hey @7hokerz, thanks for reporting this. At the moment, I can’t seem to reproduce the issue. If you are encountering an error running the deploy command on the Firebase CLI, could you please share the firebase-debug.log if it exists? If not, please rerun the command with --debug.

Also, the Cloud Build seems to be erroring out when trying to install the dependencies in your Next.js application. By any chance, could you provide your package.json and package-lock.json or steps on how you set up your Next.js project?

@aalej

package.json dependencies.

"dependencies": {
    "@hookform/resolvers": "^4.1.3",
    "@radix-ui/react-accordion": "^1.2.3",
    "@radix-ui/react-alert-dialog": "^1.1.6",
    "@radix-ui/react-avatar": "^1.1.3",
    "@radix-ui/react-checkbox": "^1.1.4",
    "@radix-ui/react-collapsible": "^1.1.11",
    "@radix-ui/react-dialog": "^1.1.6",
    "@radix-ui/react-dropdown-menu": "^2.1.6",
    "@radix-ui/react-label": "^2.1.2",
    "@radix-ui/react-menubar": "^1.1.6",
    "@radix-ui/react-popover": "^1.1.6",
    "@radix-ui/react-progress": "^1.1.2",
    "@radix-ui/react-radio-group": "^1.2.3",
    "@radix-ui/react-scroll-area": "^1.2.3",
    "@radix-ui/react-select": "^2.1.6",
    "@radix-ui/react-separator": "^1.1.2",
    "@radix-ui/react-slider": "^1.2.3",
    "@radix-ui/react-slot": "^1.2.3",
    "@radix-ui/react-switch": "^1.1.3",
    "@radix-ui/react-tabs": "^1.1.3",
    "@radix-ui/react-toast": "^1.2.6",
    "@radix-ui/react-tooltip": "^1.1.8",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "date-fns": "^3.6.0",
    "embla-carousel-react": "^8.6.0",
    "firebase": "^12.3.0",
    "firebase-admin": "^13.5.0",
    "genkit": "^1.20.0",
    "lucide-react": "^0.545.0",
    "next": "15.3.3",
    "next-themes": "^0.3.0",
    "react": "^18.3.1",
    "react-day-picker": "^8.10.1",
    "react-dom": "^18.3.1",
    "react-hook-form": "^7.65.0",
    "recharts": "^2.15.4",
    "tailwind-merge": "^3.0.1",
    "tailwindcss-animate": "^1.0.7",
    "zod": "^3.25.76"
  },
  "devDependencies": {
    "@types/node": "^22.18.10",
    "@types/react": "^18.3.25",
    "@types/react-dom": "^18.3.7",
    "firebase-tools": "^14.19.1",
    "genkit-cli": "^1.20.0",
    "postcss": "^8.5.6",
    "tailwindcss": "^3.4.17",
    "typescript": "^5.9.3"
  }

Please follow these steps.

1. rm -rf node_modules package-lock.json
2. npm i
3. npm ls picomatch
4. npm i (or npm update)

• Once step 2 is complete, you can see the dependency in package-lock.json.

"node_modules/tinyglobby/node_modules/picomatch": {
      "version": "4.0.3",
      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "engines": {
        "node": ">=12"
      },
      "funding": {
        "url": "https://github.com/sponsors/jonschlinkert"
      }
    },

• In step 3, you can check the dependency tree.

├─┬ firebase-tools@14.19.1
│ ├─┬ chokidar@3.6.0
│ │ ├─┬ anymatch@3.1.3
│ │ │ └── picomatch@2.3.1 deduped
│ │ └─┬ readdirp@3.6.0
│ │   └── picomatch@2.3.1 deduped
│ └─┬ superstatic@9.2.0
│   └─┬ re2@1.22.1
│     └─┬ node-gyp@11.5.0
│       └─┬ tinyglobby@0.2.15
│         ├─┬ fdir@6.5.0
│         │ └── picomatch@4.0.3 deduped
│         └── picomatch@4.0.3
└─┬ tailwindcss@3.4.18
  └─┬ micromatch@4.0.8
    └── picomatch@2.3.1

• However, once step 4 is complete, the picomatch version 4.0.3 of tinyglobby will be removed from package-lock.json and an error will be displayed in the dependency tree. (Same as when the first issue was raised.) (npm ls picomatch)

Please contact me if you have any additional requirements!

[7hokerz]

@aalej Temporarily, i can work around this issue by specifying picomatch: 4.0.3 in the overrides field in package.json. However, I think this is only a temporary solution.

[7hokerz]

@aalej hello?

[Al38andr0]

Hi there,

Just to let you know you are not alone, @7hokerz, I have the same issue. Every time I change anything in my deps and push to CI, I get this error.

The only way to get rid of it is to delete the node_modules folder and the lock file, then reinstall everything and push again.

[aalej]

Hey @7hokerz , sorry I wasn't able to get back to this sooner. Taking a look into this again, I can’t seem to reproduce the issue locally. I used the package.json you shared and ran the commands you provided, but npm ls picomatch isn't raising any errors(even after running npm update). Also, the picomatch version in package-lock.json seems to still stay the same(4.0.3) after npm update. Here's my repro, I'm not sure if I may be missing something here, if I am please let me know.

Although the dependency issue seems to be coming from superstatic, I’ll try to ask someone from our engineering team who is familiar with the library to take a look.

@Al38andr0 just to verify, is the dependency conflict you're getting also related to picomatch?

[7hokerz]

Hey @7hokerz , sorry I wasn't able to get back to this sooner. Taking a look into this again, I can’t seem to reproduce the issue locally. I used the package.json you shared and ran the commands you provided, but npm ls picomatch isn't raising any errors(even after running npm update). Also, the picomatch version in package-lock.json seems to still stay the same(4.0.3) after npm update. Here's my repro, I'm not sure if I may be missing something here, if I am please let me know.

Although the dependency issue seems to be coming from superstatic, I’ll try to ask someone from our engineering team who is familiar with the library to take a look.

@Al38andr0 just to verify, is the dependency conflict you're getting also related to picomatch?

That's weird. I just tested it just in case, and I get the same error.

├─┬ firebase-tools@14.24.0
│ ├─┬ chokidar@3.6.0
│ │ ├─┬ anymatch@3.1.3
│ │ │ └── picomatch@2.3.1 deduped
│ │ └─┬ readdirp@3.6.0
│ │   └── picomatch@2.3.1 deduped
│ └─┬ superstatic@9.2.0
│   └─┬ re2@1.22.1
│     └─┬ node-gyp@11.5.0
│       └─┬ tinyglobby@0.2.15
│         ├─┬ fdir@6.5.0
│         │ └── picomatch@2.3.1 deduped invalid: "^4.0.3" from node_modules/tinyglobby, "^3 || ^4" from node_modules/tinyglobby/node_modules/fdir
│         └── picomatch@2.3.1 deduped invalid: "^4.0.3" from node_modules/tinyglobby
├─┬ tailwindcss@3.4.18
│ └─┬ micromatch@4.0.8
│   └── picomatch@2.3.1

Additionally, There doesn't seem to be anything wrong with your process.

[7hokerz]

Hi there,

Just to let you know you are not alone, @7hokerz, I have the same issue. Every time I change anything in my deps and push to CI, I get this error.

The only way to get rid of it is to delete the node_modules folder and the lock file, then reinstall everything and push again.

Your method is also effective, but is also temporary.
If i run npm i or npm update or etc... it gives in the same error.