Skip to content

[BUG] package-lock.json missing resolved/integrity for most packages #2683

Description

@ShowhyT

package-lock.json (on v3.36.0 and main) is missing resolved/integrity for most entries, e.g.:

"node_modules/@azure/core-client": {
  "version": "1.10.0",
  "license": "MIT",
  "dependencies": { ... }
}

vs a normal entry:

"node_modules/@azure/identity": {
  "version": "4.13.1",
  "resolved": "https://registry.npmjs.org/@azure/identity/-/identity-4.13.1.tgz",
  "integrity": "sha512-...",
  ...
}

This usually happens when the lockfile is regenerated/updated while npm already has the packages in its local cache — npm skips writing resolved/integrity in that case (npm/cli#4260, npm/cli#4263).

Breaks anything that needs to fetch deps offline from the lockfile (npm ci in air-gapped CI, Nix's buildNpmPackage, etc). Trying to build the nixpkgs azurite package fails with:

npm error code ENOTCACHED
npm error request to https://registry.npmjs.org/yocto-queue failed: cache mode is 'only-if-cached' but no cached response is available.

npm itself flags it on install:

warning: 760 out of 847 packages (89.7%) are missing 'resolved' URLs and will not be cached.
warning: Consider regenerating upstream's lockfile with: npm install --package-lock-only

Probably Fix: regenerate the lockfile with an empty npm cache / no node_modules:

rm -rf node_modules package-lock.json
npm install

and commit the result.
Thank you

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions