lockfile-stale

"The lockfile does not satisfy package.json — an `npm ci` would fail."

Venue: check — The lockfile does not satisfy package.json — an npm ci would fail.

Rule

package-lock.json must be consistent with package.json: every dependency the manifest asks for is present in the lockfile, at a version its range accepts.

Like lockfile-missing, this is a property of the workspace, not of any one template, and is reported once.

Reason

Your submission is installed with npm ci, which does not resolve versions — it installs exactly what the lockfile pins, and aborts if the lockfile and the manifest disagree. A lockfile that cannot reproduce the tree is not a slightly-out-of-date convenience file; it is an install that does not happen.

Checking it here means you see it now. Otherwise the first thing to notice is the install on our side, and the first thing you hear is that your submission was rejected.

There are two ways authors get here, and both are ordinary:

Hand-editing a version in package.json — bumping ^11.0.0 to ^12.0.0 in the editor and never running an install.
Merging a branch and keeping only one side of the lockfile — resolving the conflict by taking package.json from one branch and package-lock.json from the other. The two now describe different trees.

Fix

Run npm install — it resyncs the lockfile to the manifest — and commit the result. Do not hand-edit package-lock.json; regenerate it. If you got here from a merge conflict, take package.json first, then let npm install rebuild the lockfile from it.

Before

package.json asks for Swiper 12; the lockfile still pins 11.

// package.json — hand-edited
{
  "dependencies": {
    "swiper": "^12.0.0"
  }
}

// package-lock.json — never regenerated
{
  "packages": {
    "node_modules/swiper": { "version": "11.2.10" }
  }
}

npm ci: Invalid: lock file's swiper@11.2.10 does not satisfy swiper@^12.0.0.

After

npm install            # resolves ^12.0.0 and rewrites package-lock.json
git add package.json package-lock.json

// package-lock.json — back in sync
{
  "packages": {
    "node_modules/swiper": { "version": "12.0.4" }
  }
}

When the check could not read a report

When check cannot get an answer out of npm at all, this rule reports nothing was measured rather than a violation:

⚠ workspace — 1 gate(s) not measured
    [template-kit/lockfile-stale] npm ls returned no parseable report, so the lockfile was never inspected.
    not measured: lockfile-stale

Nothing is wrong with your lockfile in that case; nothing looked at it. The usual cause is npm not being resolvable from the environment check runs in.

This is a coverage hole, not a finding — it does not fail the run, exactly like lockfile-missing. Do not read it as a pass either: the gate is still owed an answer, and a submission is only accepted on a run that measured every gate.

Run the command yourself in the workspace:

npm ls --json --package-lock-only

Whatever stops it printing a JSON report is the thing to fix, then re-run check. Do not regenerate or commit a lockfile on the strength of this message.