Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
npm overrides that work fine with npm 8.5.5, are causing an error during npm ci as of npm 8.6:
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Missing: trim-newlines@1.0.0 from lock file
After running npm install again (as suggested by the error message) npm ci is working again, but the transient trim-newlines dependency version is no longer overridden in package-lock.json.
Expected Behavior
npm install with overrides configuration should produce a package-lock.json that can be processed by npm ci and contains overridden versions.
Steps To Reproduce
On a local development machine, create a blank project with defaults and add a dependency with vulnerable transient dependency:
mkdir npm-overrides-issue
cd npm-overrides-issue
npm init
npm i svg2sprite-cli-> 3 high severity vulnerabilities
add overrides configuration to mitigate transient vulnerability
"overrides": {
"trim-newlines": "^3.0.1"
}then
npm i
npm ci-> still 3 high severity vulnerabilities, ci still works
force update of package-lock.json
rm -rf package-lock.json node_modules
npm i
npm ci-> found 0 vulnerabilities, ci fails with the following error
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Missing: trim-newlines@1.0.0 from lock file
in order to check that it actually works with previous npm versions:
npm i -g npm@8.5.5
rm -rf package-lock.json node_modules
npm i
npm ci-> found 0 vulnerabilities, ci works as expected
Environment
- npm: 8.6.0
- Node.js: v16.14.0
- OS Name: MacOS
- System Model Name: MacBook Pro 2021
- npm config:
; "user" config from /Users/redacted/.npmrc
; redacted: custom registry configuration for internal dependencies, not related
; node bin location = /Users/redacted/.nvm/versions/node/v16.14.0/bin/node
; cwd = /Users/redacted/dev/npm-overrides-issue
; HOME = /Users/redacted
; Run `npm config ls -l` to show all defaults.- package.json
{
"name": "npm-overrides-issue",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"dependencies": {
"svg2sprite-cli": "^2.0.1"
},
"overrides": {
"trim-newlines": "^3.0.1"
}
}