npm/cli
Pull Request Overview
- Opened on October 12, 2026
- Status Open
- Commit count 1 with first commit October 12, 2026
Total Delta
Open Days
Test Delta
How long has this pull request spent in each phase of its lifecycle?
Data pending calculation for pull request
fix: accept omitted unresolved optional packages in npm ci
Before the lockfile lookup, validateLockfile now skips an ideal-tree entry when it is inert and entry.package?.version is absent. Not run locally for lib/utils/validate-lockfile.js: npm test could not run in this environment (tap is not installed).
npm ci aborts and reports that package.json and the lockfile are out of sync, listing unresolved platform-specific optional packages such as @esbuild/*, @napi-rs/*, @rollup/rollup-*, and fsevents as missing. Those entries are the optional native packages that npm install no longer writes into the lockfile. validateLockfile walks every ideal-tree entry and treats a key missing from the virtual tree as lockfile drift. Shrinkwrap.commit omits inert nodes that have no package version, and those nodes are unresolved optional dependencies, so a lockfile that correctly left them out is reported as out of sync.
npm test could not run in this environment (tap is not installed).
The targeted JavaScript check found no runner and did not execute the new validate-lockfile test.
The npm test script failed to start the suite because tap is not available.
References
Closes #10043
Is there an existing issue for this?
- [x] I have searched the existing issues
This issue exists in the latest npm version
- [x] I am using the latest npm
This is not just a request to bump a dependency for a CVE
- [x] This is not solely a request to bump a dependency for a CVE
Current Behavior
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: @napi-rs/nice-android-arm-eabi@ from lock file
npm error Missing: @napi-rs/nice-android-arm64@ from lock file
npm error Missing: @napi-rs/nice-darwin-arm-eabi@ from lock file
npm error Missing: @napi-rs/nice-darwin-x64@ from lock file
npm error Missing: @esbuild/aix-ppc64@ from lock file
npm error Missing: @esbuild/android-arm@ from lock file
npm error Missing: @esbuild/android-arm64@ from lock file
npm error Missing: @esbuild/android-x64@ from lock file
npm error Missing: @esbuild/darwin-arm64@ from lock file
npm error Missing: @esbuild/darwin-x64@ from lock file
npm error Missing: @esbuild/freebsd-arm64@ from lock file
npm error Missing: @esbuild/freebsd-x64@ from lock file
npm error Missing: @esbuild/linux-arm@ from lock file
npm error Missing: @esbuild/linux-arm64@ from lock file
npm error Missing: @esbuild/linux-ia32@ from lock file
npm error Missing: @esbuild/linux-loong64@ from lock file
npm error Missing: @esbuild/linux-mips64el@ from lock file
npm error Missing: @esbuild/linux-ppc64@ from lock file
npm error Missing: @esbuild/linux-riscv64@ from lock file
npm error Missing: @esbuild/linux-s390x@ from lock file
npm error Missing: @esbuild/netbsd-x64@ from lock file
npm error Missing: @esbuild/openbsd-x64@ from lock file
npm error Missing: @esbuild/sunos-x64@ from lock file
npm error Missing: @esbuild/win32-arm64@ from lock file
npm error Missing: @esbuild/win32-ia32@ from lock file
npm error Missing: @esbuild/win32-x64@ from lock file
npm error Missing: @rollup/rollup-android-arm-eabi@ from lock file
npm error Missing: @rollup/rollup-android-arm64@ from lock file
npm error Missing: @rollup/rollup-darwin-arm64@ from lock file
npm error Missing: @rollup/rollup-darwin-x64@ from lock file
npm error Missing: @rollup/rollup-linux-arm-gnueabihf@ from lock file
npm error Missing: @rollup/rollup-linux-arm-musleabihf@ from lock file
npm error Missing: @rollup/rollup-linux-arm64-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-arm64-musl@ from lock file
npm error Missing: @rollup/rollup-linux-powerpc64le-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-riscv64-gnu@ from lock file
npm error Missing: @rollup/rollup-linux-s390x-gnu@ from lock file
npm error Missing: @rollup/rollup-win32-arm64-msvc@ from lock file
npm error Missing: @rollup/rollup-win32-ia32-msvc@ from lock file
npm error Missing: @rollup/rollup-win32-x64-msvc@ from lock file
npm error Missing: fsevents@ from lock file
This also seems to be happening to rolldown, unrs, msgpackr, lmdb, and parcel. Seems to only happen to the OS dependencies.
Noticing the package-lock.json file is removing lines like this for each
"node_modules/esbuild/node_modules//@esbuild/aix-ppc64": {
"dev": true,
"optional": true
}
...
I have added the allowScripts in the package.json like the following but I don't think this would cause the issue (it still removes them and complains if allow scripts is missing)
"allowScripts": {
"@parcel/watcher": true,
"esbuild": true,
"protobufjs": true,
"unrs-resolver": true
}
Expected Behavior
I expected npm ci to just install the packages as it always did with 11.11.0 and earlier
Steps To Reproduce
It seems since 11.17.0, npm fails as it removes "node_modules/esbuild/node_modules//@esbuild/aix-ppc64" and others out of the lock , but npm 11.11.0 and earlier keeps them in the lock and functions just fine.
Steps:
1. Deleted the package-lock.json file and node_modules
2. Ran npm install
3. Ran npm ci
this might be related to #8805 or #4828 to maybe something that has been undone to cause this issue
Environment
- npm: 11.17.0, 11.16.0
- Node.js: 24.19.0, 24.18.1
- OS Name: Linux
- System Model Name: Various
- npm config:
No comments have been left on this PR.