How to fix npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@3, but package-lock.json was generated for lockfileVersion@2 in npm

npmINTERMEDIATELOWUpdated Dec 3, 2025· 209 views

This warning occurs when your npm version expects a different lockfile format than what package-lock.json contains. Different npm versions use different lockfile formats (v1, v2, v3), causing team collaboration and CI/CD issues.

Quick fix

Fixes npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@3, but package-lock.json was generated for lockfileVersion@2

# Your npm version
npm --version

# Lock file version
head -5 package-lock.json
# Look for "lockfileVersion": X
  1. Check current versions
  2. Standardize team npm version (recommended)
  3. Regenerate lock file with current npm
  4. Pin lockfile version if needed
npm — error
# Your npm version
npm --version
# Lock file version
head -5 package-lock.json
# Look for "lockfileVersion": X
npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@3, but package-lock.json was generated for lockfileVersion@2

What this error means

The lockfileVersion field in package-lock.json indicates the format specification used. Different npm versions generate different formats: - lockfileVersion 1: npm v5-v6 (legacy) - lockfileVersion 2: npm v7-v8 (includes backwards compatibility) - lockfileVersion 3: npm v9+ (optimized, no backwards compatibility) When your npm version doesn't match the lockfile version, you may see warnings or unexpected behavior.

Typical symptoms

  • Warning about lockfile version mismatch
  • Large diffs in package-lock.json after npm install
  • CI fails with lockfile-related errors
  • Team members getting different node_modules
  • npm ci fails or produces warnings

Common causes

  1. Team members using different npm versions
  2. CI/CD pipeline using different npm than local
  3. Recently upgraded Node.js (which bundles new npm)
  4. Lock file committed from different npm version
  5. Docker image using different npm version

How to fix "npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@3, but package-lock.json was generated for lockfileVersion@2"

1Check current versions

Identify the mismatch:

bash
# Your npm version
npm --version

# Lock file version
head -5 package-lock.json
# Look for "lockfileVersion": X

Version mapping:
- npm 6 → lockfileVersion 1
- npm 7-8 → lockfileVersion 2
- npm 9+ → lockfileVersion 3

2Standardize team npm version (recommended)

Create .nvmrc file for consistent Node/npm:

bash
echo "20" > .nvmrc

Team members use:

bash
nvm use
# Now using Node 20, npm 10

This ensures everyone generates the same lockfile format.

3Regenerate lock file with current npm

Create a fresh lock file matching your npm version:

bash
# Delete old lock file
rm package-lock.json

# Regenerate
npm install

# Verify version
head -5 package-lock.json

Commit the new lock file for the team.

4Pin lockfile version if needed

If you need backwards compatibility (e.g., team still on npm 8):

bash
# Force lockfileVersion 2
npm install --lockfile-version=2 --package-lock-only

Or set permanently in .npmrc:

bash
lockfile-version=2
5Update CI/CD to match

Ensure CI uses the same npm version:

yaml
# GitHub Actions
- uses: actions/setup-node@v4
  with:
    node-version-file: '.nvmrc'

- name: Install dependencies
  run: npm ci

Docker:

dockerfile
FROM node:20-alpine
RUN npm install -g npm@10
6Document for team onboarding

Add to README or CONTRIBUTING.md:

markdown
## Node.js Version
This project uses Node.js 20 with npm 10.
Run `nvm use` to switch to the correct version.

## Lockfile
package-lock.json uses lockfileVersion 3.
Requires npm 9+.

Advanced notes

lockfileVersion 3 benefits:
- 30-40% smaller file size (no legacy dependencies section)
- Faster parsing
- Only packages section (location-aware mapping)

lockfileVersion 2 benefits:
- Works with npm 7-10
- Backwards compatible with npm 6 (via dependencies section)
- Better for teams transitioning

For monorepos or workspaces, lockfile version consistency is especially important as multiple packages share one lock file.

Never manually edit package-lock.json—let npm manage it. If conflicts occur, delete and regenerate rather than trying to merge.

Frequently asked questions

What does "npm WARN read-shrinkwrap This version of npm is compatible with lockfi" mean?
json indicates the format specification used. Different npm versions generate different formats: - lockfileVersion 1: npm v5-v6 (legacy) - lockfileVersion 2: npm v7-v8 (includes backwards compatibility) - lockfileVersion 3: npm v9+ (optimized, no backwards compatibility) When your npm version doesn't match the lockfile version, you may see warnings or unexpected behavior.
How do I fix "npm WARN read-shrinkwrap This version of npm is compatible with lockfi"?
This warning occurs when your npm version expects a different lockfile format than what package-lock.json contains. Different npm versions use different lockfile formats (v1, v2, v3), causing team collaboration and CI/CD issues.
What causes "npm WARN read-shrinkwrap This version of npm is compatible with lockfi"?
Team members using different npm versions CI/CD pipeline using different npm than local Recently upgraded Node.js (which bundles new npm)
Is the "npm WARN read-shrinkwrap This version of npm is compatible with lockfi" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading