flow inconsistent Package-Lock for Vaadin 24.8.8

Description of the bug

I executed "clean vaadin:clean-frontend install -Dvaadin.ci.build=false -P production". Then I excuted "clean install -Dvaadin.ci.build=true -P production" and get a NPM error: "Lock file's [email protected] does not satisfy [email protected]".

The package-lock.json-file I got with the first command is inconsistent: Vaadin forces 3.2.6. But NPM takes 3.2.7

Here are some lines of my Package-Lock.json:

"node_modules/@vaadin/bundles": { ... "dompurify": "3.2.6", ... }

"node_modules/@vaadin/markdown": { ... "dompurify": "^3.2.5", ... }

"node_modules/dompurify": { "version": "3.2.7", ... }

Expected behavior

A consistence Package-Lock.json.

Minimal reproducible example

I hope, it is possible to find the error without example

Versions

Vaadin / Flow version: 24.8.8
Java version: 21
OS version: Windows 11
Browser version (if applicable):
Application Server (if applicable):
IDE (if applicable):

Sep 25 '25 10:09 ArianeAriane

Same with 24.9.1 and no custom package.json or package-lock.json in place.

08:43:49  [INFO] --- vaadin:24.9.1:build-frontend (build-frontend) @ i3s-pwd-reset ---
08:43:56  [INFO] Reflections took 6338 ms to scan 187 urls, producing 13812 keys and 65068 values
08:43:56  [INFO] Scanning classes to find frontend configurations and dependencies...
08:43:59  [INFO] Visited 3488 classes. Took 3385 ms.
08:43:59  [INFO] Checking if a production mode bundle build is needed
08:43:59  [INFO] Dependency lit:3.3.1 has the wrong version 3.3.0 in the bundle
08:43:59  [INFO] Dependency react-router:7.6.3 has the wrong version 7.6.1 in the bundle
08:43:59  [INFO] A production mode bundle build is needed
08:43:59  [INFO] Running `npm ci` to resolve and optionally download frontend dependencies. This may take a moment, please stand by...
08:44:00  [INFO] using '/opt/node-v22.19.0-linux-x64/bin/npm --no-update-notifier --no-audit --scripts-prepend-node-path=true --ignore-scripts ci' for frontend package installation
08:44:08  [ERROR] Command `/opt/node-v22.19.0-linux-x64/bin/npm --no-update-notifier --no-audit --scripts-prepend-node-path=true --ignore-scripts ci` failed:
08:44:08  npm warn Unknown cli config "--scripts-prepend-node-path". This will stop working in the next major version of npm.
08:44:08  npm warn Unknown user config "store-dir". This will stop working in the next major version of npm.
08:44:08  npm warn Unknown user config "set strict-peer-dependencies". This will stop working in the next major version of npm.
08:44:08  npm error code EUSAGE
08:44:08  npm error
08:44:08  npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
08:44:08  npm error
08:44:08  npm error Invalid: lock file's @preact/[email protected] does not satisfy @preact/[email protected]
08:44:08  npm error Invalid: lock file's @rollup/[email protected] does not satisfy @rollup/[email protected]
08:44:08  npm error Invalid: lock file's @types/[email protected] does not satisfy @types/[email protected]
08:44:08  npm error Invalid: lock file's @vitejs/[email protected] does not satisfy @vitejs/[email protected]
08:44:08  npm error Invalid: lock file's [email protected] does not satisfy [email protected]
08:44:08  npm error Invalid: lock file's [email protected] does not satisfy [email protected]
08:44:08  npm error Invalid: lock file's [email protected] does not satisfy [email protected]
08:44:08  npm error Invalid: lock file's [email protected] does not satisfy [email protected]
08:44:08  npm error Invalid: lock file's [email protected] does not satisfy [email protected]
08:44:08  npm error Invalid: lock file's @rolldown/[email protected] does not satisfy @rolldown/[email protected]
08:44:08  npm error

Sep 30 '25 08:09 sephiroth-j

The dompurify version has been updated in latest @vaadin/bundles here https://github.com/vaadin/bundles/pull/169 and should be included into 24.8.8 and 24.9.1, but we'll double check.

Sep 30 '25 10:09 mshabarov

Solved with 24.8.9 for me.

Sep 30 '25 16:09 knoobie

I get this error in 24.9.1

curl -s -f 'https://start.vaadin.com/dl?&preset=default&projectName=default' -o 'default.zip'
unzip -q 'default.zip'
cd 'default'
grep /vaadin.version pom.xml
<vaadin.version>24.9.1</vaadin.version>
mvn

Checking if a development mode bundle build is needed
Dependency lit:3.3.1 has the wrong version 3.3.0 in the bundle
Dependency react-router:7.6.3 has the wrong version 7.6.1 in the bundle
A development mode bundle build is needed

Oct 01 '25 05:10 manolo

if I unpack my ~/.m2/repository/com/vaadin/vaadin-dev-bundle/24.9.1/vaadin-dev-bundle-24.9.1.jar I have this in vaadin-dev-bundle/hybrid-package-lock.json

"lit": "3.3.0", 
"react-router": "7.6.1"

but right now content in ~/.m2/repository/com/vaadin/vaadin-dev-bundle/24.9-SNAPSHOT/vaadin-dev-bundle-SNAPSHOT.jar is correct.

It also happened with 24.8.8

Oct 01 '25 08:10 manolo

issue in vaadin 24.9 has been fixed in the 24.9.2 release.

Oct 03 '25 15:10 ZheSun88

issue in vaadin 24.9 has been fixed in the 24.9.2 release.

I can confirm that.

Oct 06 '25 07:10 sephiroth-j

Hi @ArianeAriane, have you tried the latest Vaadin 24.8 release, which is 24.8.10? does it fix this issue mentioned here for you?

Oct 07 '25 06:10 ZheSun88

No. I try it with Version 24.8.10. This is the console output: [ERROR] Command C:\[...]\nodejs\v21\npm.cmd --no-update-notifier --no-audit --scripts-prepend-node-path=true --ignore-scripts ci failed: npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '@isaacs/[email protected]', npm warn EBADENGINE required: { node: '20 || >=22' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '@isaacs/[email protected]', npm warn EBADENGINE required: { node: '20 || >=22' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '[email protected]', npm warn EBADENGINE required: { node: '20 || >=22' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '[email protected]', npm warn EBADENGINE required: { node: '20 || >=22' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '[email protected]', npm warn EBADENGINE required: { node: '20 || >=22' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '[email protected]', npm warn EBADENGINE required: { node: '20 || >=22' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '[email protected]', npm warn EBADENGINE required: { node: '20 || >=22' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm warn EBADENGINE Unsupported engine { npm warn EBADENGINE package: '[email protected]', npm warn EBADENGINE required: { node: '^18.0.0 || ^20.0.0 || >=22.0.0' }, npm warn EBADENGINE current: { node: 'v21.6.2', npm: '10.8.1' } npm warn EBADENGINE } npm error code EUSAGE npm error npm error npm ci can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with npm install before continuing. npm error npm error Invalid: lock file's [email protected] does not satisfy [email protected] npm error npm error Clean install a project

Oct 20 '25 13:10 ArianeAriane

Now I tried it with Version 24.9.3 and get this error:

[ERROR] Command C:\Program Files\nodejs\npm.cmd --no-update-notifier --no-audit --scripts-prepend-node-path=true --ignore-scripts ci failed: npm error code EUSAGE npm error npm error npm ci can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with npm install before continuing. npm error npm error Invalid: lock file's @preact/[email protected] does not satisfy @preact/[email protected] npm error Invalid: lock file's @rollup/[email protected] does not satisfy @rollup/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vitejs/[email protected] does not satisfy @vitejs/[email protected] npm error Invalid: lock file's [email protected] does not satisfy [email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @vaadin/[email protected] does not satisfy @vaadin/[email protected] npm error Invalid: lock file's @rolldown/[email protected] does not satisfy @rolldown/[email protected] npm error npm error Clean install a project npm error npm error Usage: npm error npm ci

Oct 20 '25 14:10 ArianeAriane