npm ci fails in webapp/: package-lock.json is out of sync with package.json

[aTakayukiToyoda]

Summary

npm ci cannot install webapp/'s dependencies: webapp/package-lock.json is out of sync with webapp/package.json, so npm refuses with EUSAGE and lists 13 missing entries.

webapp/ is installed with npm install (Makefile, webapp_node_modules_all), which happily reconciles the difference, so the problem stays invisible until something asks for a lockfile-pinned install. The practical effect is that webapp/ cannot currently be installed reproducibly: a container image or CI job that wants pinned dependencies has to fall back to npm install, which is free to resolve different transitive versions between builds.

Reproduction

Using only webapp/package.json and webapp/package-lock.json from main (227055c7), with nothing else in the directory:

$ docker run --rm -v "$PWD:/w" -w /w node:20-bookworm npm ci --no-audit --no-fund
npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: diff@3.2.0 from lock file
npm error Missing: growl@1.9.2 from lock file
npm error Missing: multer@1.4.4 from lock file
npm error Missing: busboy@0.2.14 from lock file
npm error Missing: mkdirp@0.5.6 from lock file
npm error Missing: dicer@0.2.5 from lock file
npm error Missing: readable-stream@1.1.14 from lock file
npm error Missing: readable-stream@1.1.14 from lock file
npm error Missing: streamsearch@0.1.2 from lock file
npm error Missing: isarray@0.0.1 from lock file
npm error Missing: string_decoder@0.10.31 from lock file
npm error Missing: minimist@1.2.8 from lock file
npm error Missing: string_decoder@0.10.31 from lock file

Environment: node v20.20.2, npm 10.8.2.

This is not recent: the same 13 entries reproduce identically against an older commit from May (637d2a85), so the lockfile has been in this state for a while.

The missing entries are the nested dependency trees of mocha's growl and diff, and of multer (busboy → dicer → readable-stream → string_decoder/isarray) — dev dependencies whose sub-trees were never written back into the lockfile.

Expected

npm ci succeeds in webapp/, so the dependency set is reproducible.

Suggested fix

Run npm install in webapp/ and commit the regenerated webapp/package-lock.json. Adding an npm ci step to CI would keep the two from drifting again — as things stand nothing in the build would notice.

Context

Found while building a Docker image for a self-contained deployment of the dashboard and switching that build from npm install to npm ci. Happy to send a PR with the regenerated lockfile if that is welcome — I held off because a lockfile regeneration is a large diff and you may prefer to fold it into a dependency update.