Skip to content

chore: put the lockfile back in sync for npm 8 - #659

Merged
cjbarth merged 1 commit into
node-saml:masterfrom
cjbarth:chore/sync-lockfile-for-npm-8
Oct 13, 2026
Merged

cjbarth merged 1 commit into
node-saml:masterfrom
cjbarth:chore/sync-lockfile-for-npm-8

Conversation

@cjbarth

@cjbarth cjbarth commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

npm ci has failed on Node 16 since #651, so CI on master is red and so is every open pull request. The Node 16 job fails first and the matrix cancels the rest, which is why all six test jobs show as failed.

npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync.
npm ERR! Missing: @types/node@26.6.5 from lock file
npm ERR! Missing: undici-types@8.9.0 from lock file

Cause

#651 moved @cjbarth/github-release-notes to 5.1.1, whose @inquirer/* packages have an optional peer dependency on @types/node >=18. The root's @types/node is 16, which doesn't satisfy that. npm 8, 9 and 10 resolve the optional peer with a nested @types/node@26.6.5 and expect it in the lockfile. npm 11 leaves an unmet optional peer unresolved and writes no entry, which is the lockfile #651 has. The Node 16 job, which runs npm 8, is the one that fails first.

Fix

The two entries npm 8 asks for, added by npm@8.19.4 install --package-lock-only. Both are dev, optional and peer, and nothing else in the lockfile changes.

npm ci --dry-run:

npm Lockfile before this PR This lockfile
8.19.4, which the Node 16 job runs fails with the error above ok
9 fails the same way ok
10 fails the same way ok
11 ok ok

npm ci && npm run build && npm test also passes locally on Node 26 with npm 11.

This comes back if npm 11 rewrites the lockfile. npm install with npm 11 removes the two entries again, and npm 10 and older then refuse it. For as long as CI has a job that runs npm 10 or older, a lockfile change in a pull request needs them kept, or re-added with the command above.

Once this merges, re-running the checks on an open pull request picks it up, since they run on the merge with master.

🤖 Generated with Claude Code

npm ci has failed on Node 16 since the release-notes tool moved to
5.1.1: npm 8 resolves an optional peer dependency on @types/node that
the lockfile had no entry for. Add the two entries npm 8 expects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cjbarth cjbarth added this to the v6.4 milestone Oct 13, 2026
@cjbarth cjbarth added the dependencies Adds, updates or removes a dependency, or changes the lockfile label Oct 13, 2026
@coderabbitai

coderabbitai Bot commented Oct 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d352ec49-b8cd-4aa4-844b-586af8978864

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Oct 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.36%. Comparing base (d12228f) to head (ee7a2f4).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #659   +/-   ##
=======================================
  Coverage   86.36%   86.36%           
=======================================
  Files           9        9           
  Lines        1283     1283           
  Branches      335      335           
=======================================
  Hits         1108     1108           
  Misses        100      100           
  Partials       75       75           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@cjbarth
cjbarth merged commit f844ded into node-saml:master Oct 13, 2026
13 checks passed
@cjbarth
cjbarth deleted the chore/sync-lockfile-for-npm-8 branch October 13, 2026 18:06
cjbarth added a commit that referenced this pull request Oct 14, 2026
Conflicts resolved to master's side: .grenrc.js (#651) and the two
package-lock.json entries from #659, keeping 6.x's 6.3.3 version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Adds, updates or removes a dependency, or changes the lockfile

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant