search

npm / cli

the package manager for JavaScript
https://docs.npmjs.com/cli/
Other
8.47k stars 3.16k forks source link

[BUG] `npm ci` succeeds when `package-lock.json` doesn't match `package.json` #2701

Closed icatalina closed 2 years ago

icatalina commented 3 years ago

Current Behavior:

npm ci does not fail when package.json doesn't match package-lock.json

Expected Behavior:

npm ci refuses to install when the lock file is invalid.

Steps To Reproduce:

  1. Manually bump a major version of a dependency in package.json
  2. Run npm ci
  3. It should fail but performs the whole installation

npm@7

image

npm@6

image

Environment: