`npm ci` fails because package.json and package-lock.json are out of sync

Symptom

npm ci fails with npm error code EUSAGE: "npm ci can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync."

Environment and tested versions

Debian GNU/Linux 13 (trixie) x86_64, node 20.19.2, npm 11.21.1, git 2.47.3

• node 20.19.2
• npm 11.21.1
• git 2.47.3

Client used in the test: Tested with the npm CLI directly (test deps is-number 7.0.0, left-pad 1.3.0).

Root cause

package.json was changed (here with npm pkg set dependencies.left-pad=1.3.0) without updating package-lock.json.

Fix steps

1. Run npm install to update the lockfile.
2. Commit package-lock.json.
3. Confirm with npm ci in a fresh clone.

Verification

Tested 31 Oct 2026 in a throwaway directory on a Linux box (fake credentials only). Before (A) and after the fix:

A: npm ci -> EUSAGE ... exit=1
B: npm install; npm ci -> exit=0
   git commit; git clone into a fresh dir; npm ci -> exit=0

Sources

• https://raw.githubusercontent.com/npm/cli/latest/docs/lib/content/commands/npm-ci.md