npm ci command fails with version 18.2.8

[acohenOT]

Command

other

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

18.2.7

Description

Using command npm ci on a clean Angualr 18.2.8 project, the command fails with an error.

Minimal Reproduction

1. Run npm new angular182. Select SCSS and no SSR.
2. cd angular182
3. run npm ci

Exception or Error

npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Invalid: lock file's [email protected] does not satisfy [email protected]
npm error Missing: [email protected] from lock file
npm error Missing: [email protected] from lock file
npm error Invalid: lock file's [email protected] does not satisfy [email protected]
npm error Missing: [email protected] from lock file
npm error Missing: [email protected] from lock file

Your Environment

Angular CLI: 18.2.8
Node: 20.18.0
Package Manager: npm 10.9.0
OS: win32 x64

Angular: 18.2.8
... animations, cli, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1802.8
@angular-devkit/build-angular   18.2.8
@angular-devkit/core            18.2.8
@angular-devkit/schematics      18.2.8
@schematics/angular             18.2.8
rxjs                            7.8.1
typescript                      5.5.4
zone.js                         0.14.10

Anything else relevant?

Same issue occurs after regenerating package-lock.json.

1. delete package-lock.json
2. delete node_modules directory
3. run npm install - regenerates package-lock.json and node_modules
4. run npm ci

[alan-agius4]

Looks like you are experiencing one of the npm ci bugs listed in: npm/cli#6787

[MarcoGlauser]

We ran into the same issue trying to upgrade our lock files with renovate.
Manual intervention with an npm install resolved it temporarily. But every time we run npm update again, it creates an invalid package-lock file.
It seems there's a certain constellation of dependencies at the moment that makes npm update fail reliably on chokidar.