generatePackageJson creates out-of-sync lock file

[timonmasberg]

Current Behavior

Running npm ci on the generated package-lock throws an error:

npm ERR! code EUSAGE
npm ERR! 
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: [email protected] from lock file
npm ERR! 
npm ERR! Clean install a project
npm ERR! 
npm ERR! Usage:
npm ERR! npm ci

Expected Behavior

Should be able to clean install, without an additional syncing (e.g. running npm i).

GitHub Repo

https://github.com/timonmasberg/nx-gen-lock-bug

Steps to Reproduce

1. Checkout repo
2. build app as prod npx nx build nx-gen-lock-bug --prod
3. run npm ci in `dist/apps/nx-gen-lock-bug``

Nx Report

Node   : 20.10.0
OS     : darwin-arm64
npm    : 10.2.3

nx                 : 18.1.2
@nx/js             : 18.1.2
@nx/jest           : 18.1.2
@nx/linter         : 18.1.2
@nx/eslint         : 18.1.2
@nx/workspace      : 18.1.2
@nx/devkit         : 18.1.2
@nx/eslint-plugin  : 18.1.2
@nx/nest           : 18.1.2
@nx/node           : 18.1.2
@nrwl/tao          : 18.1.2
@nx/web            : 18.1.2
@nx/webpack        : 18.1.2
typescript         : 5.3.3

Failure Logs

No response

Package Manager Version

No response

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

I added some dependencies which made the package lock invalid (see package.json and app.module.ts), on a clean workspace generated with the nestjs template it works. Furthermore, I believe this was working until we migrated from 17.2.8 to 18.1.2, which might be related.

[joe-passenger]

Any updates on how this is going? This is a significant blocker for us that is preventing us from moving to node 18/20.

[fgirardey]

I have the same issue with the missing ms package. It turns out that as soon as you import express in a Nest project the generatePackageJson option generates a problematic package-lock.json file.

A common scenario in a NestJS app is to import the Request type from express in a controller. As soon as you do so it generates a problematic package-lock.json.

[BaptisteMahe]

Same issue here, with the following nx report:

   Node   : 20.13.1
   OS     : darwin-arm64
   npm    : 10.5.2
   
   nx                 : 17.2.6
   @nx/js             : 17.2.6
   @nx/jest           : 17.2.6
   @nx/linter         : 17.2.6
   @nx/eslint         : 17.2.6
   @nx/workspace      : 17.2.6
   @nx/angular        : 17.2.6
   @nx/cypress        : 17.2.6
   @nx/devkit         : 17.0.3
   @nx/eslint-plugin  : 17.2.6
   @nx/express        : 17.2.6
   @nx/nest           : 17.2.6
   @nx/node           : 17.2.6
   @nrwl/tao          : 17.2.6
   @nx/web            : 17.2.6
   @nx/webpack        : 17.2.6
   nx-cloud           : 17.0.0
   typescript         : 5.2.2
   ---------------------------------------
   Community plugins:
   @auth0/auth0-angular    : 2.2.3
   @cypress/schematic      : 1.7.0
   angular-calendar        : 0.31.1
   ng-mocks                : 14.12.2
   ngx-extended-pdf-viewer : 18.1.14

The generated package-lock.json produces the following error when trying to run npm ci on a build output from a NestJs project:

`npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
Missing: [email protected] from lock file

The generated package-lock.json works fine for express-based and plain node apps.

@fgirardey for the record, one of the NestJs app that fails the same way doesn't have any explicit reference to express in the source code.

[JamesHenry]

Apologies, I have just seen the attached repo, I still get an error when following the steps in the OP in 19.2.2

We will look into this

[github-actions]

This issue has been closed for more than 30 days. If this issue is still occuring, please open a new issue with more recent context.