NPM CI fails when node-red-node-email-5.0.2 is present in package.json

[rebecaaaa]

Which node are you reporting and issue on?

node-red-node-email

What are the steps to reproduce?

The first step is to install the package in the latest version.

 npm i node-red-node-email

added 1 package in 883ms

12 packages are looking for funding
  run `npm fund` for details
npm notice
npm notice New minor version of npm available! 11.6.2 -> 11.7.0
npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.7.0
npm notice To update run: npm install -g npm@11.7.0
npm notice

Then, check if the package was successfully installed.

 $ cat package.json 
{
  "dependencies": {
    "node-red-node-email": "^5.0.2"
  }
}

Run npm ci to see the errors:

 $ npm ci
npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: semver@5.3.0 from lock file
npm error
npm error Clean install a project
npm error
npm error Usage:
npm error npm ci
npm error
npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
npm error [--no-bin-links] [--no-fund] [--dry-run]
npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm error [--workspaces] [--include-workspace-root] [--install-links]
npm error
npm error aliases: clean-install, ic, install-clean, isntall-clean
npm error
npm error Run "npm help ci" for more info
npm error A complete log of this run can be found in: /home/rebeca/.npm/_logs/2025-12-11T13_19_47_559Z-debug-0.log

Workaround

To fix the error in my case, I added the following override rule in the package.json:

 {
   "dependencies": {
     "node-red-node-email": "^5.0.2"
+  },
+  "overrides": {
+    "utf7": {
+      "semver": "^5.7.2"
+    }
   }
 }

And update the package-lock.json:

npm install

added 1 package, and audited 44 packages in 2s

12 packages are looking for funding
  run `npm fund` for details

4 low severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Now it's possible to run the npm ci with no problem

npm ci

added 1 package, and audited 44 packages in 943ms

12 packages are looking for funding
  run `npm fund` for details

4 low severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

What happens?

Run npm ci to see the errors:

 $ npm ci
npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: semver@5.3.0 from lock file
npm error
npm error Clean install a project
npm error
npm error Usage:
npm error npm ci
npm error
npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
npm error [--no-bin-links] [--no-fund] [--dry-run]
npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm error [--workspaces] [--include-workspace-root] [--install-links]
npm error
npm error aliases: clean-install, ic, install-clean, isntall-clean
npm error
npm error Run "npm help ci" for more info
npm error A complete log of this run can be found in: /home/rebeca/.npm/_logs/2025-12-11T13_19_47_559Z-debug-0.log

What did you expect to happen?

To install the package using npm ci without problems.

Example flow

No response

Environment

• Node-RED version: 4.x
• Node.js version: 24.12.0
• npm version: 11.6.2
• Platform/OS: Linux Mint 22.1

[hardillb]

I think this is because we already have the equivalent override in the node-red-node-email package.json file, because utf7 is basically abandoned (last updated 9 years ago) and is pinned at ~5.3.0 for semver. (But it doesn't need to change).

Also utf7 is not a direct dependency, it's pulled in by the imap package.

I'm not sure what we can do about this.

The only think I can think of would be if we included the package-lock.json in the node-red-node-email package, but that is just speculation at this point.

[dceejay]

I guess the question is "why isn't the overall (project level) package-lock.json getting updated correctly when the newer version of the email node installs and adds its dependencies that include overrides?"

is it this ? npm/cli#4232