Issue 1:
Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

npm overrides that work fine with npm 8.5.5, are causing an error during npm ci as of npm 8.6:

npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Missing: trim-newlines@1.0.0 from lock file

After running npm install again (as suggested by the error message) npm ci is working again, but the transient trim-newlines dependency version is no longer overridden in package-lock.json.

Expected Behavior

npm install with overrides configuration should produce a package-lock.json that can be processed by npm ci and contains overridden versions.

Steps To Reproduce

On a local development machine, create a blank project with defaults and add a dependency with vulnerable transient dependency:

mkdir npm-overrides-issue
cd npm-overrides-issue
npm init
npm i svg2sprite-cli

-> 3 high severity vulnerabilities

add overrides configuration to mitigate transient vulnerability

"overrides": {
"trim-newlines": "^3.0.1"
}

then

npm i
npm ci

-> still 3 high severity vulnerabilities, ci still works

force update of package-lock.json

rm -rf package-lock.json node_modules
npm i
npm ci

-> found 0 vulnerabilities, ci fails with the following error

npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Missing: trim-newlines@1.0.0 from lock file

in order to check that it actually works with previous npm versions:

npm i -g npm@8.5.5
rm -rf package-lock.json node_modules
npm i
npm ci

-> found 0 vulnerabilities, ci works as expected

Environment

npm: 8.6.0

Node.js: v16.14.0

OS Name: MacOS

System Model Name: MacBook Pro 2021

npm config:

; "user" config from /Users/redacted/.npmrc

; redacted: custom registry configuration for internal dependencies, not related

; node bin location = /Users/redacted/.nvm/versions/node/v16.14.0/bin/node
; cwd = /Users/redacted/dev/npm-overrides-issue
; HOME = /Users/redacted
; Run `npm config ls -l` to show all defaults.

package.json

{
"name": "npm-overrides-issue",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"dependencies": {
"svg2sprite-cli": "^2.0.1"
},
"overrides": {
"trim-newlines": "^3.0.1"
}
}

Issue 2:
Creating a new React app in E:\myapp.

Installing packages. This might take a couple of minutes.

Installing react, react-dom, and react-scripts with cra-template...

npm ERR! cb() never called!

npm ERR! This is an error with npm itself. Please report this error at:

npm ERR! https://npm.community

npm ERR! A complete log of this run can be found in:

npm ERR! C:\Users\HP\AppData\Roaming\npm-cache_logs\2020-05-10T11_24_52_824Z-debug.log

Aborting installation.

npm install --save --save-exact --loglevel error react react-dom react-scripts cra-template has failed.

Deleting generated file... package.json

Deleting myapp/ from E:

Done.