You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "Oskar-Bonde (via GitHub)" <gi...@apache.org> on 2025/06/24 13:34:36 UTC
[I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Oskar-Bonde opened a new issue, #33881:
URL: https://github.com/apache/superset/issues/33881
### Bug description
It is currently not possible to run `npm ci` in Superset 4.1.0, 4.1.1 and 4.1.2. The following error is raised:
"Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1"
`npm ci` worked fine 2025-06-19, but has not worked since 2025-06-23.
Running `npm install` bumps luxon to 3.6.1, after which `npm ci` works fine.
### Screenshots/recordings
_No response_
### Superset version
4.1.2
### Python version
3.10
### Node version
18 or greater
### Browser
Chrome
### Additional context
I've tested this on branches 4.1.0, 4.1.1 and 4.1.2. No code changes made.
Full error message:
```
npm ERR! code EUSAGE
npm ERR!
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1
```
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3000590368
<!-- Greeting -->
Hi @Oskar-Bonde! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
This error is happening because Superset's package.json specifies luxon as "^3.5.0", but the package-lock.json in the repo was generated when luxon@3.5.0 was the latest version. When luxon@3.6.1 was published (between June 19 and June 23, 2025), npm started expecting the lockfile to reference 3.6.1 (the latest version matching "^3.5.0"), but the lockfile still points to 3.5.0. This is a normal npm integrity check: if a new patch version is published and the lockfile isn't updated, npm ci will fail with this error.
Running npm install updates the lockfile to reference luxon@3.6.1, resolving the mismatch and allowing npm ci to work again. This isn't a Superset-specific bug—it's a common scenario in npm projects when dependencies release new versions and the lockfile isn't updated promptly.
Best practice is to update and commit package-lock.json whenever a new compatible dependency version is published. There are no official Superset docs or issues addressing this, but it's standard npm behavior and applies to any project using unpinned dependency ranges like "^3.5.0" for luxon. No recent changes in the Superset repo caused this; it's due to the new luxon release in the npm registry.
Reference: ["luxon" dependency in package.json](https://github.com/apache/superset/blob/98b35125c2a562bb2a61a26e6acd3430339320aa/superset-frontend/package.json)
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/5ebb47a7-1791-49a9-99df-8aff13419928?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5ebb47a7-1791-49a9-99df-8aff13419928?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5ebb47a7-1791-49a9-99df-8aff13419928?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5ebb47a7-1791-49a9-99df-8aff13419928?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5ebb47a7-1791-49a9-99df-8aff13419928?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5ebb47a7-1791-49a9-99df-8aff13419928?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5ebb47a7-1791-49a9-99df-8aff13419928?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [!
[Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/33881)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "Oskar-Bonde (via GitHub)" <gi...@apache.org>.
Oskar-Bonde commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3432159976
A similar issue has now occurred again.
See new issue #35797
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3002093242
Hmm... I haven't tried `4.1.2` lately, but `npm install` seems to be working fine on 5.0. Maybe worth testing that release, and if you find an issue there, it seems like an easy PR to update the resulting package lock.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "danlewis85 (via GitHub)" <gi...@apache.org>.
danlewis85 commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3006071106
I found I could fix this issue by updating the `package-lock.json` file - going to superset-frontend and running `npm i --package-lock-only` then building again sorted this for me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "Oskar-Bonde (via GitHub)" <gi...@apache.org>.
Oskar-Bonde commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3003833313
This issue does not affect `5.0.0`, `npm ci` work fine. I'm more concerned about what the root cause of this issue is. And how do we prevent something like this from happening again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "EmmanuelCbd (via GitHub)" <gi...@apache.org>.
EmmanuelCbd commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3000896316
Same issue here. I was searching for this issue and found your message on slack, and opened issue.
I was able to build last week, but not today
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "Oskar-Bonde (via GitHub)" <gi...@apache.org>.
Oskar-Bonde commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3000630977
@dosu luxon@3.6.1 was released 3 months ago.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "EmmanuelCbd (via GitHub)" <gi...@apache.org>.
EmmanuelCbd commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3003871214
`4.1.2` was building fine, until yesterday.
My hypothesis, would be the upgrade of a node module inbetween, nut I'm not very familiar with `npm ci` behaviour (if it downloads dependecies), explaining why it works after a npm install.
the diff, in packages-lock.json, is only on upgrading luxon from 3.5.0 to 3.6.1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #33881:
URL: https://github.com/apache/superset/issues/33881#issuecomment-3000690407
<!-- Answer -->
You're right—luxon@3.6.1 was released months ago, so the timing of the npm ci breakage isn't due to a new luxon release or any change in the Superset repo. This kind of error can appear suddenly because npm ci enforces that package.json and package-lock.json are perfectly in sync. If the lockfile was generated with luxon@3.5.0 but the allowed range is ^3.5.0, npm will expect the latest matching version (3.6.1) to be resolved, depending on how the npm registry responds or if npm itself changes its integrity checks. Sometimes, registry metadata or npm client updates can trigger stricter enforcement, causing builds that previously worked to start failing even if nothing changed in your repo or in the luxon package itself.
The best way to avoid this is to regularly update and commit package-lock.json whenever a new compatible dependency version is published and matches your semver range. There’s no evidence of other dependencies or repo changes causing this—it's just standard npm/lockfile behavior when using semver ranges and not updating the lockfile promptly. If you notice any other symptoms or dependencies involved, let me know!
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/2a29a6a7-000e-494f-aeb9-1e3b3a8d3c0e?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/2a29a6a7-000e-494f-aeb9-1e3b3a8d3c0e?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/2a29a6a7-000e-494f-aeb9-1e3b3a8d3c0e?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/2a29a6a7-000e-494f-aeb9-1e3b3a8d3c0e?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/2a29a6a7-000e-494f-aeb9-1e3b3a8d3c0e?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/2a29a6a7-000e-494f-aeb9-1e3b3a8d3c0e?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/2a29a6a7-000e-494f-aeb9-1e3b3a8d3c0e?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [!
[Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/33881)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1" [superset]
Posted by "Oskar-Bonde (via GitHub)" <gi...@apache.org>.
Oskar-Bonde closed issue #33881: Cannot build Superset 4.1.2: npm ci raises error "Invalid: lock file's luxon@3.5.0 does not satisfy luxon@3.6.1"
URL: https://github.com/apache/superset/issues/33881
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org