Frontend package-lock.json out of sync: clean npm ci fails, blocking the #60 bundle build

Found on 28 Oct 2026, during the #60 bundle build (runbook phase A) on a fresh WSL Ubuntu 24.04.

What happened

bash scripts/offline/build_bundle.sh stopped at step 3/4:

npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync.
npm error Missing: lru-cache@11.5.3 from lock file

It reproduces on main 415ac9e with Node 22.23.4 and npm 10.9.9 (Claude's workspace), so it isn't the build machine.
Why the 26 Oct rehearsals passed: build_bundle.sh runs npm ci only when node_modules is missing, and the workspace already had it. CI never runs a clean frontend install.

Also found: the frontend now needs Node 22.12+ (@tanstack/react-start requires >=22.12.0), but build_bundle.sh, docs/offline-install.md and QUICKSTART.md all said Node 20.

Fix

package-lock.json: regenerate with npm install --package-lock-only. It adds the one missing entry, node_modules/nitro/node_modules/lru-cache 11.5.3. No other version changes.
build_bundle.sh: always run npm ci, so a stale lock file can't hide again.
Docs: Node 22.12+ in the three places above.

Done when

Merged with CI green.
The 2026-11-15: ship air-gapped install procedure or keep interim wording #60 bundle build (runbook A4) completes on the dev machine's WSL Ubuntu 24.04, with its last line attached here.

Generated by Claude Code

Merge pull request #131 from amar-python/fix/frontend-lockfile

Reopened under the closure rule: no issue closes without clean evidence attached.

PR #131 was merged on 28 Oct (9413fb8), with CI 3/3. The "Done when" still needs runbook A4 to complete on the dev machine's WSL Ubuntu 24.04, with its last line attached here.

Generated by Claude Code

Evidence: clean build passed. The product owner reran runbook step A4 on 28 Oct, in WSL Ubuntu 24.04.5 with Node v22.23.4 and npm 10.9.9, at main 2f10940 (PRs #131 and #134 merged).

Key lines from the output:

Now using node v22.23.4 (npm v10.9.9)
== 1/4 application source (git HEAD 2f10940)
== 2/4 Python wheels for CPython 3.12, manylinux x86_64
== 3/4 frontend, built for a plain Node server
added 506 packages, and audited 507 packages in 46s
...
== 4/4 Ubuntu packages: PostgreSQL 16, Python venv, Node.js, with dependencies
Bundle: /home/user/PostgreDataMigrationAppWithCSVLoader/dist/offline-bun…

npm ci now succeeds from a clean install. That was the failure this issue tracked.
build_bundle.sh runs under set -euo pipefail. It prints Bundle: only after the tarball and its .sha256 are written, so all 4 steps completed.
The last line was cut off when the output was pasted. The bundle's size and checksum will be recorded under 2026-11-15: ship air-gapped install procedure or keep interim wording #60, at runbook step A5.

Other output:

npm audit reports 1 high: zod. That's tracked in Frontend dependencies: npm audit reports 6 critical (TanStack Start XSS) and 8 high #132.
The MODULE_LEVEL_DIRECTIVE "use client" warnings come from Vite and Rolldown. They're existing build warnings and don't stop the build.

Closing.

Generated by Claude Code

Navigation Menu

Repository navigation

Frontend package-lock.json out of sync: clean npm ci fails, blocking the #60 bundle build #130

What happened

Fix

Done when

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Frontend package-lock.json out of sync: clean npm ci fails, blocking the #60 bundle build #130

Description

What happened

Fix

Done when

Activity

amar-python commented on Oct 27, 2026

amar-python commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions