How to fix npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync in npm

npmBEGINNERMEDIUMUpdated Dec 6, 2025· 283 views

The npm ci sync error occurs when package.json and package-lock.json have mismatched dependencies. Run npm install locally to regenerate the lockfile, then commit the changes.

Quick fix

Fixes npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync

# Delete lockfile and reinstall
rm package-lock.json
npm install

# Commit the new lockfile
git add package-lock.json
git commit -m "Regenerate package-lock.json"
  1. Regenerate the lockfile
  2. Update lockfile without full reinstall
  3. Full clean reinstall
  4. Match npm configuration across environments
npm — error
# Delete lockfile and reinstall
rm package-lock.json
npm install
# Commit the new lockfile
git add package-lock.json
git commit -m "Regenerate package-lock.json"
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync

What this error means

npm ci (clean install) is designed for automated environments and requires strict synchronization between package.json and package-lock.json. Unlike `npm install`, which updates the lockfile when mismatches are found, `npm ci` fails immediately if there's any discrepancy. This error typically occurs when someone edited package.json without running npm install afterward, or when team members use different npm versions that generate incompatible lockfiles.

Typical symptoms

  • npm ci fails in CI/CD while npm install works locally
  • Error appears after editing package.json manually
  • Fresh repository clone fails at npm ci step
  • Docker builds fail during dependency installation
  • Works locally but fails after pushing to CI
  • Different results between team members

Common causes

  1. package.json was edited without running npm install afterward
  2. Different npm versions between local and CI environments
  3. package-lock.json wasn't committed after dependency changes
  4. Merge conflicts in package.json or package-lock.json
  5. Using --legacy-peer-deps locally but not in CI
  6. npm version downgrade (npm 9 lockfile with npm 8)

How to fix "npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync"

1Regenerate the lockfile

Run npm install locally to sync the files:

bash
# Delete lockfile and reinstall
rm package-lock.json
npm install

# Commit the new lockfile
git add package-lock.json
git commit -m "Regenerate package-lock.json"
2Update lockfile without full reinstall

If you just need to sync the lockfile:

bash
# Update lockfile only
npm install --package-lock-only

# Commit changes
git add package-lock.json
git commit -m "Sync package-lock.json"
3Full clean reinstall

For a complete reset:

bash
# Remove everything
rm -rf node_modules package-lock.json

# Clear cache
npm cache clean --force

# Reinstall
npm install

# Verify npm ci works
npm ci
4Match npm configuration across environments

If using flags like --legacy-peer-deps, add to .npmrc:

bash
# Create .npmrc in project root
echo "legacy-peer-deps=true" >> .npmrc

# Commit .npmrc
git add .npmrc
git commit -m "Add npm configuration"

This ensures CI uses the same settings as local development.

5Standardize Node/npm versions

Ensure same versions everywhere:

bash
# Create .nvmrc
node -v > .nvmrc

# Add engines to package.json
{
  "engines": {
    "node": ">=18.0.0",
    "npm": ">=9.0.0"
  }
}

Update CI configuration to use matching versions.

6Use npm install in CI (fallback)

If npm ci keeps failing, use npm install as fallback:

yaml
# GitHub Actions example
- name: Install dependencies
  run: npm install
  # instead of: npm ci

Note: This is less strict but more forgiving of mismatches.

Advanced notes

npm ci was introduced specifically for CI/CD environments where reproducibility is critical. It:
1. Deletes node_modules before installing
2. Installs exact versions from package-lock.json
3. Never modifies package.json or package-lock.json
4. Fails fast if files are out of sync

The strict behavior is intentional—it prevents surprise package updates during deployments. The error is a feature, not a bug.

For Docker builds, run npm install inside the Docker container to ensure the lockfile matches the container's npm version, not your host machine's.

Frequently asked questions

What does "npm ERR! `npm ci` can only install packages when your package.json and" mean?
json. Unlike npm install, which updates the lockfile when mismatches are found, npm ci fails immediately if there's any discrepancy. json without running npm install afterward, or when team members use different npm versions that generate incompatible lockfiles.
How do I fix "npm ERR! `npm ci` can only install packages when your package.json and"?
The npm ci sync error occurs when package.json and package-lock.json have mismatched dependencies. Run npm install locally to regenerate the lockfile, then commit the changes.
What causes "npm ERR! `npm ci` can only install packages when your package.json and"?
package.json was edited without running npm install afterward Different npm versions between local and CI environments package-lock.json wasn't committed after dependency changes
Is the "npm ERR! `npm ci` can only install packages when your package.json and" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading