NPM is (probably) broken in CI

[BenHenning]

Check for duplicates

• I have searched for similar issues before opening a new one.

Description

#9469 is demonstrating this, but multiple workflows are now failing when trying to run npm ci even without build version changes.

Reproduction steps

Create a PR and see failing CI runs. It doesn't seem possible to manually trigger any of the failing workflows through Actions (so a PR is necessary), but it's failing in basically all PRs currently: #9472.

Priority

Very significant--all PRs are essentially blocked without fixing this.

Stack trace

npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: fsevents@2.3.3 from lock file
npm error
npm error Clean install a project
npm error
npm error Usage:
npm error npm ci
npm error
npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
npm error [--no-bin-links] [--no-fund] [--dry-run]
npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm error [--workspaces] [--include-workspace-root] [--install-links]
npm error
npm error aliases: clean-install, ic, install-clean, isntall-clean
npm error
npm error Run "npm help ci" for more info
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-11-18T23_43_35_842Z-debug-0.log

Screenshots

No response

Browsers

No response

[BenHenning]

Since no version updates have happened this is very likely caused by a change on GitHub's side in their Ubuntu image (since we run against latest).

What's especially weird is that running npm ci locally doesn't fail, and predictably npm install doesn't actually attempt to change the package lock file.

[BenHenning]

I'm fairly sure https://github.blog/changelog/2025-10-10-strengthening-npm-security-important-changes-to-authentication-and-token-management/ is somehow related to this since the topic and timeline map perfectly, but I'm not yet sure how. It would definitely explain the discrepancy between CI and local runs as well.

[BenHenning]

I wasn't able to trigger the failure but updating my local npm to 11.6.2 (from 9.x) allowed me to correctly update package-lock.json which includes an addition of fsevents, hopefully fixing the issue.