How to fix npm ERR! code ENOLOCK npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 194 views

This ENOLOCK error occurs when npm ci detects mismatched package.json and package-lock.json files. Regenerate the lockfile by running npm install and commit it to version control.

Quick fix

Fixes ENOLOCK

pwd

# List files to verify both exist
ls -la | grep package
  1. Verify you are in the correct project directory
  2. Regenerate the package-lock.json file
  3. Check for package-lock.json JSON syntax errors
  4. Ensure consistent Node.js and npm versions across environments
npm — error
pwd
# List files to verify both exist
ls -la | grep package
npm ERR! code ENOLOCK
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync

What this error means

The npm ENOLOCK error occurs when running `npm ci` and the package.json and package-lock.json (or npm-shrinkwrap.json) files are not synchronized. The `npm ci` (clean install) command is designed for CI/CD pipelines and requires an exact match between the declared dependencies in package.json and the locked versions in package-lock.json. Unlike `npm install`, which can create or modify lock files, `npm ci` treats lock files as immutable and will fail rather than update them, ensuring reproducible builds. This error is common in team environments or automated deployments where the files get out of sync.

Typical symptoms

  • CI/CD pipeline fails with 'npm ERR! code ENOLOCK' during npm ci step
  • Local npm install works fine, but npm ci fails in Docker containers or CI systems
  • Error message states package-lock.json and package.json are not in sync
  • Team members have different package-lock.json files after merging branches
  • Switching between npm versions causes sync validation failures

Common causes

  1. package.json was manually edited without running npm install to update the lock file
  2. Git merge conflict in package-lock.json was resolved incorrectly, leaving corrupted JSON
  3. Different npm versions used locally vs CI (e.g., npm 10.x locally but npm 9.x in Docker image)
  4. Running npm install on one machine generates a lock file that npm ci on another machine considers out-of-sync
  5. package-lock.json was deleted or missing from the repository while package.json changes exist
  6. npm install was run with flags like --save without committing the updated lock file

How to fix "npm ERR! code ENOLOCK npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync"

1Verify you are in the correct project directory

Confirm you're in the root directory where package.json and package-lock.json are located:

bash
pwd

# List files to verify both exist
ls -la | grep package
2Regenerate the package-lock.json file

Delete the existing lock file and node_modules directory, then run npm install to create a fresh, synchronized lock file:

bash
# Remove lock file and dependencies
rm -rf package-lock.json npm-shrinkwrap.json node_modules/

# Regenerate lock file with current npm version
npm install

# Verify npm ci now works
npm ci
3Check for package-lock.json JSON syntax errors

If you suspect a merge conflict corrupted the lock file, validate its JSON structure:

bash
# Validate JSON syntax
node -e "JSON.parse(require('fs').readFileSync('package-lock.json', 'utf8'))" && echo 'Valid JSON'

# If invalid, regenerate
rm package-lock.json && npm install
4Ensure consistent Node.js and npm versions across environments

Verify your local npm version matches what's used in CI/Docker:

bash
# Check local versions
node --version
npm --version

# Update npm if needed
npm install -g npm@latest

# In Dockerfile, specify exact npm version
FROM node:20.10-alpine
RUN npm install -g npm@10.5.0

Commit package-lock.json after updating to lock the format version.

5Run npm install multiple times if using npm with known bugs

In some npm versions, npm ci may incorrectly report out-of-sync status. Running install twice can resolve the issue:

bash
# First install
npm install

# Second install (forces lock file update)
npm install

# Now try npm ci
npm ci
6For CI/CD pipelines: commit lock file and use npm ci consistently

Ensure package-lock.json is committed to version control:

bash
# In your Git workflow
git add package.json package-lock.json
git commit -m 'Update dependencies'

# In CI pipeline
script:
  - npm ci
  - npm run build
  - npm test

# In Dockerfile
COPY package*.json ./
RUN npm ci --only=production

Always commit both files together and use npm ci in automated environments.

Advanced notes

The npm ci command was introduced specifically for continuous integration to guarantee reproducible builds. It reads ONLY from package-lock.json and will reject installation if dependencies differ from package.json. Known issue: Some npm versions generate lock files that subsequent npm ci invocations report as unsynchronized despite no actual changes. The workaround is running npm install twice or clearing the lock file entirely. For monorepos with workspaces, ensure all package-lock.json files at each workspace root are synchronized.

Frequently asked questions

What does "ENOLOCK" mean?
json) files are not synchronized. json. Unlike npm install, which can create or modify lock files, npm ci treats lock files as immutable and will fail rather than update them, ensuring reproducible builds.
How do I fix "ENOLOCK"?
This ENOLOCK error occurs when npm ci detects mismatched package.json and package-lock.json files. Regenerate the lockfile by running npm install and commit it to version control.
What causes "ENOLOCK"?
package.json was manually edited without running npm install to update the lock file Git merge conflict in package-lock.json was resolved incorrectly, leaving corrupted JSON Different npm versions used locally vs CI (e.g., npm 10.x locally but npm 9.x in Docker image)
Is the "ENOLOCK" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading