`generatePackageJson` creates out-of-sync lock file

[timonmasberg]

Current Behavior

Running npm ci on the generated package-lock throws an error:

npm ERR! code EUSAGE
npm ERR! 
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: [email protected] from lock file
npm ERR! 
npm ERR! Clean install a project
npm ERR! 
npm ERR! Usage:
npm ERR! npm ci

Expected Behavior

Should be able to clean install, without an additional syncing (e.g. running npm i).

GitHub Repo

https://github.com/timonmasberg/nx-gen-lock-bug

Steps to Reproduce

1. Checkout repo
2. build app as prod npx nx build nx-gen-lock-bug --prod
3. run npm ci in `dist/apps/nx-gen-lock-bug``

Nx Report

Node   : 20.10.0
OS     : darwin-arm64
npm    : 10.2.3

nx                 : 18.1.2
@nx/js             : 18.1.2
@nx/jest           : 18.1.2
@nx/linter         : 18.1.2
@nx/eslint         : 18.1.2
@nx/workspace      : 18.1.2
@nx/devkit         : 18.1.2
@nx/eslint-plugin  : 18.1.2
@nx/nest           : 18.1.2
@nx/node           : 18.1.2
@nrwl/tao          : 18.1.2
@nx/web            : 18.1.2
@nx/webpack        : 18.1.2
typescript         : 5.3.3

Failure Logs

No response

Package Manager Version

No response

Operating System

• [X] macOS
• [ ] Linux
• [ ] Windows
• [ ] Other (Please specify)

Additional Information

I added some dependencies which made the package lock invalid (see package.json and app.module.ts), on a clean workspace generated with the nestjs template it works. Furthermore, I believe this was working until we migrated from 17.2.8 to 18.1.2, which might be related.

[joe-passenger]

Any updates on how this is going? This is a significant blocker for us that is preventing us from moving to node 18/20.

[fgirardey]

I have the same issue with the missing ms package. It turns out that as soon as you import express in a Nest project the generatePackageJson option generates a problematic package-lock.json file.

A common scenario in a NestJS app is to import the Request type from express in a controller. As soon as you do so it generates a problematic package-lock.json.

[BaptisteMahe]

Same issue here, with the following nx report:

   Node   : 20.13.1
   OS     : darwin-arm64
   npm    : 10.5.2
   
   nx                 : 17.2.6
   @nx/js             : 17.2.6
   @nx/jest           : 17.2.6
   @nx/linter         : 17.2.6
   @nx/eslint         : 17.2.6
   @nx/workspace      : 17.2.6
   @nx/angular        : 17.2.6
   @nx/cypress        : 17.2.6
   @nx/devkit         : 17.0.3
   @nx/eslint-plugin  : 17.2.6
   @nx/express        : 17.2.6
   @nx/nest           : 17.2.6
   @nx/node           : 17.2.6
   @nrwl/tao          : 17.2.6
   @nx/web            : 17.2.6
   @nx/webpack        : 17.2.6
   nx-cloud           : 17.0.0
   typescript         : 5.2.2
   ---------------------------------------
   Community plugins:
   @auth0/auth0-angular    : 2.2.3
   @cypress/schematic      : 1.7.0
   angular-calendar        : 0.31.1
   ng-mocks                : 14.12.2
   ngx-extended-pdf-viewer : 18.1.14

The generated package-lock.json produces the following error when trying to run npm ci on a build output from a NestJs project:

`npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
Missing: [email protected] from lock file

The generated package-lock.json works fine for express-based and plain node apps.

@fgirardey for the record, one of the NestJs app that fails the same way doesn't have any explicit reference to express in the source code.

[JamesHenry]

Hi Folks, there have been a number of improvements in this area since the latest report.

Please can I request that someone tries with the latest Nx (19.2.2 at the time of writing) and reports back?

If it is still an issue, please provide minimal steps to reproduce.

Many thanks!

[JamesHenry]

Apologies, I have just seen the attached repo, I still get an error when following the steps in the OP in 19.2.2

We will look into this

[github-actions[bot]]

This issue has been closed for more than 30 days. If this issue is still occuring, please open a new issue with more recent context.