Next.js · build error

npm ci: package.json and package-lock.json are not in sync

what it looks like
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.

What it means

Someone (often an agent fixing something else) changed the next version in package.json without updating package-lock.json, so a clean install refuses to run. The lockfile is what pins the exact version you tested: a range like ^16.4.3 in package.json allows any later 16.x, so without a committed lockfile each install can build against a different Next.js.

Common causes

  • An agent edited the next, react or eslint-config-next version in package.json, or ran npm install next@latest, while fixing something else
  • package-lock.json is in .gitignore, wasn't committed, or was deleted to "fix" an install error
  • next, eslint-config-next and react changed in different commits

How to fix it

  1. See what's installed: npm ls next react react-dom
  2. Pin the exact version you last tested (use yours): npm pkg set dependencies.next=16.4.3 devDependencies.eslint-config-next=16.4.3, run npm install to update package-lock.json, then commit both files together
  3. Use npm ci in CI and deploy builds so installs match the lockfile exactly
  4. Upgrade on purpose in its own branch: npx @next/codemod@canary upgrade latest, then run the build and tests
terminal
npm ls next react react-dom
npm pkg set dependencies.next=16.4.3 devDependencies.eslint-config-next=16.4.3
npm install
git add package.json package-lock.json
git commit -m "Pin next to 16.4.3"
npm ci && npm run build

works with Next.js 16.4.3 · React 19.3last verified

prevent it · 00-workflow.mdc (free Cursor Rules Pack): The agent doesn't bump next, react or other framework packages unless the task asks for it.

Prompt for Cursor or Claude Code

npm ci fails because package.json and package-lock.json are out of sync on next. Don't upgrade anything. Find which commit changed the next/react/eslint-config-next versions, restore the last version the app built with, pin it as an exact version (no ^), regenerate the lockfile with npm install, and confirm npm ci && npm run build pass. List every version you changed.

Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Next.js error fixer.

next: skip the next one

Skip the setup. The VibeBoot SaaS Starter gives you auth, Stripe and a database already wired on Next.js 16.4.3, with AGENTS.md and .cursor/rules that keep your agent on the Next.js 16 conventions. $49, one-time.

14-day money-back guarantee · lifetime updates

$ fixed it? get the next one first

New fixes for what AI agents break, by email.

When we add a fix or a Cursor rule for a new Next.js, Auth.js, Prisma or Stripe break, it goes out in the VibeBoot newsletter. Free, occasional, unsubscribe in one click.

Subscribe free