template-kit/lockfile-stale

The lockfile must satisfy package.json. If npm ci would fail, this fails first — on your machine, where you can still do something about it.

Rule

package-lock.json must be consistent with package.json: every dependency the manifest asks for is present in the lockfile, at a version its range accepts.

Like lockfile-missing, this is a property of the workspace, not of any one template, and is reported once.

Reason

Your submission is installed with npm ci, which does not resolve versions — it installs exactly what the lockfile pins, and aborts if the lockfile and the manifest disagree. A lockfile that cannot reproduce the tree is not a slightly-out-of-date convenience file; it is an install that does not happen.

Checking it here means you see it now. Otherwise the first thing to notice is the install on our side, and the first thing you hear is that your submission was rejected.

There are two ways authors get here, and both are ordinary:

• Hand-editing a version in package.json — bumping ^11.0.0 to ^12.0.0 in the editor and never running an install.
• Merging a branch and keeping only one side of the lockfile — resolving the conflict by taking package.json from one branch and package-lock.json from the other. The two now describe different trees.

Fix

Run npm install — it resyncs the lockfile to the manifest — and commit the result. Do not hand-edit package-lock.json; regenerate it. If you got here from a merge conflict, take package.json first, then let npm install rebuild the lockfile from it.

Before

package.json asks for Swiper 12; the lockfile still pins 11.

// package.json — hand-edited
{
  "dependencies": {
    "swiper": "^12.0.0"
  }
}

// package-lock.json — never regenerated
{
  "packages": {
    "node_modules/swiper": { "version": "11.2.10" }
  }
}

npm ci: Invalid: lock file's swiper@11.2.10 does not satisfy swiper@^12.0.0.

After

npm install            # resolves ^12.0.0 and rewrites package-lock.json
git add package.json package-lock.json

// package-lock.json — back in sync
{
  "packages": {
    "node_modules/swiper": { "version": "12.0.4" }
  }
}

See also

• lockfile-missing — there is no lockfile at all.
• single-react — the other property of the installed tree the platform checks before it builds your page.