<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">This issue exists in the latest npm version</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I am using the latest npm</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">npm overrides that work fine with npm 8.5.5, are causing an error during <code class="notranslate">npm ci</code> as of  npm 8.6:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: trim-newlines@1.0.0 from lock file"><pre class="notranslate"><code class="notranslate">npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: trim-newlines@1.0.0 from lock file
</code></pre></div>
<p dir="auto">After running <code class="notranslate">npm install</code> again (as suggested by the error message) <code class="notranslate">npm ci</code> is working again, but the transient <code class="notranslate">trim-newlines</code> dependency version is no longer overridden in package-lock.json.</p>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto"><code class="notranslate">npm install</code> with <code class="notranslate">overrides</code> configuration should produce a package-lock.json that can be processed by <code class="notranslate">npm ci</code> and contains overridden versions.</p>
<h3 dir="auto">Steps To Reproduce</h3>
<p dir="auto">On a local development machine, create a blank project with defaults and add a dependency with vulnerable transient dependency:</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="mkdir npm-overrides-issue
cd npm-overrides-issue
npm init
npm i svg2sprite-cli"><pre class="notranslate">mkdir npm-overrides-issue
<span class="pl-c1">cd</span> npm-overrides-issue
npm init
npm i svg2sprite-cli</pre></div>
<p dir="auto">-&gt; 3 high severity vulnerabilities</p>
<p dir="auto">add overrides configuration to mitigate transient vulnerability</p>
<div class="highlight highlight-source-json notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="  &quot;overrides&quot;: {
    &quot;trim-newlines&quot;: &quot;^3.0.1&quot;
  }"><pre class="notranslate">  <span class="pl-ent">"overrides"</span>: {
    <span class="pl-ent">"trim-newlines"</span>: <span class="pl-s"><span class="pl-pds">"</span>^3.0.1<span class="pl-pds">"</span></span>
  }</pre></div>
<p dir="auto">then</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="npm i
npm ci"><pre class="notranslate">npm i
npm ci</pre></div>
<p dir="auto">-&gt; still 3 high severity vulnerabilities, <code class="notranslate">ci</code> still works</p>
<p dir="auto">force update of package-lock.json</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="rm -rf package-lock.json node_modules
npm i
npm ci"><pre class="notranslate">rm -rf package-lock.json node_modules
npm i
npm ci</pre></div>
<p dir="auto">-&gt; found 0 vulnerabilities, <code class="notranslate">ci</code> fails with the following error</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: trim-newlines@1.0.0 from lock file"><pre class="notranslate"><code class="notranslate">npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! Missing: trim-newlines@1.0.0 from lock file
</code></pre></div>
<p dir="auto">in order to check that it actually works with previous npm versions:</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="npm i -g npm@8.5.5
rm -rf package-lock.json node_modules
npm i
npm ci"><pre class="notranslate">npm i -g npm@8.5.5
rm -rf package-lock.json node_modules
npm i
npm ci</pre></div>
<p dir="auto">-&gt; found 0 vulnerabilities, <code class="notranslate">ci</code> works as expected</p>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>npm: 8.6.0</li>
<li>Node.js: v16.14.0</li>
<li>OS Name: MacOS</li>
<li>System Model Name: MacBook Pro 2021</li>
<li>npm config:</li>
</ul>
<div class="highlight highlight-source-ini notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="; &quot;user&quot; config from /Users/redacted/.npmrc

; redacted: custom registry configuration for internal dependencies, not related

; node bin location = /Users/redacted/.nvm/versions/node/v16.14.0/bin/node
; cwd = /Users/redacted/dev/npm-overrides-issue
; HOME = /Users/redacted
; Run `npm config ls -l` to show all defaults."><pre class="notranslate"><span class="pl-c"><span class="pl-c">;</span> "user" config from /Users/redacted/.npmrc</span>

<span class="pl-c"><span class="pl-c">;</span> redacted: custom registry configuration for internal dependencies, not related</span>

<span class="pl-c"><span class="pl-c">;</span> node bin location = /Users/redacted/.nvm/versions/node/v16.14.0/bin/node</span>
<span class="pl-c"><span class="pl-c">;</span> cwd = /Users/redacted/dev/npm-overrides-issue</span>
<span class="pl-c"><span class="pl-c">;</span> HOME = /Users/redacted</span>
<span class="pl-c"><span class="pl-c">;</span> Run `npm config ls -l` to show all defaults.</span></pre></div>
<ul dir="auto">
<li>package.json</li>
</ul>
<div class="highlight highlight-source-json notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="{
  &quot;name&quot;: &quot;npm-overrides-issue&quot;,
  &quot;version&quot;: &quot;1.0.0&quot;,
  &quot;description&quot;: &quot;&quot;,
  &quot;main&quot;: &quot;index.js&quot;,
  &quot;scripts&quot;: {
    &quot;test&quot;: &quot;echo \&quot;Error: no test specified\&quot; &amp;&amp; exit 1&quot;
  },
  &quot;author&quot;: &quot;&quot;,
  &quot;license&quot;: &quot;ISC&quot;,
  &quot;dependencies&quot;: {
    &quot;svg2sprite-cli&quot;: &quot;^2.0.1&quot;
  },
  &quot;overrides&quot;: {
    &quot;trim-newlines&quot;: &quot;^3.0.1&quot;
  }
}"><pre class="notranslate">{
  <span class="pl-ent">"name"</span>: <span class="pl-s"><span class="pl-pds">"</span>npm-overrides-issue<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"version"</span>: <span class="pl-s"><span class="pl-pds">"</span>1.0.0<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"description"</span>: <span class="pl-s"><span class="pl-pds">"</span><span class="pl-pds">"</span></span>,
  <span class="pl-ent">"main"</span>: <span class="pl-s"><span class="pl-pds">"</span>index.js<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"scripts"</span>: {
    <span class="pl-ent">"test"</span>: <span class="pl-s"><span class="pl-pds">"</span>echo <span class="pl-cce">\"</span>Error: no test specified<span class="pl-cce">\"</span> &amp;&amp; exit 1<span class="pl-pds">"</span></span>
  },
  <span class="pl-ent">"author"</span>: <span class="pl-s"><span class="pl-pds">"</span><span class="pl-pds">"</span></span>,
  <span class="pl-ent">"license"</span>: <span class="pl-s"><span class="pl-pds">"</span>ISC<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"dependencies"</span>: {
    <span class="pl-ent">"svg2sprite-cli"</span>: <span class="pl-s"><span class="pl-pds">"</span>^2.0.1<span class="pl-pds">"</span></span>
  },
  <span class="pl-ent">"overrides"</span>: {
    <span class="pl-ent">"trim-newlines"</span>: <span class="pl-s"><span class="pl-pds">"</span>^3.0.1<span class="pl-pds">"</span></span>
  }
}</pre></div>
<p dir="auto">Creating a new React app in E:\myapp.</p>
<p dir="auto">Installing packages. This might take a couple of minutes.<br>
Installing react, react-dom, and react-scripts with cra-template...</p>
<p dir="auto">npm ERR! cb() never called!</p>
<p dir="auto">npm ERR! This is an error with npm itself. Please report this error at:<br>
npm ERR!     <a href="https://npm.community" rel="nofollow">https://npm.community</a></p>
<p dir="auto">npm ERR! A complete log of this run can be found in:<br>
npm ERR!     C:\Users\HP\AppData\Roaming\npm-cache_logs\2020-05-10T11_24_52_824Z-debug.log</p>
<p dir="auto">Aborting installation.<br>
npm install --save --save-exact --loglevel error react react-dom react-scripts cra-template has failed.</p>
<p dir="auto">Deleting generated file... package.json<br>
Deleting myapp/ from E:<br>
Done.</p>