[BUG] Overrides are not updating after running npm install

[Exelord]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

After updating the overrides, npm install is not updating the package.lock or node_modules.

To make it work I had to remove both package.lock and node_modules, then the overrides have been applied.

Expected Behavior

Change in overrides should update package.lock and node_modules after running npm install

Steps To Reproduce

1. Add a dependency
2. npm install
3. Add override
4. npm install

Environment

• npm: >=8.3.0
• Node.js: 16.13.2
• OS Name: macOS 12
• System Model Name:
• npm config:

; copy and paste output from `npm config ls` here

[rushilsrivastava]

Also facing it on 8.3.2

[lautapercuspain]

It's reproducible on NPM v 8.1.2 as well.

• Node.js: 16.13.2
• MacOS Monterrey 12.0.1

[zzdjk6]

Same issue here.

OS: MacOS 11.3.1
Node: 16.13.2
NPM: 8.3.2

[shdb2]

Experiencing the same issue.
Node: 16.13.2
npm: 8.4.0

[koflin]

Same here:

• NPM: 8.4.1
• Node: 16.13.2
• OS: Windows 10

[dbjorge]

Wanted to clarify that for some variations of this scenario, the results are even worse than "npm install doesn't update package-lock.json". Below is a repro case where the results are "npm install does update package-lock.json, such that a reviewer looking quickily over a diff would think that the override has taken effect, but actually it has only partially updated package-lock.json and the version of the package in node_modules does not reflect the override".

# Baseline setup, all as expected
> node --version
v16.14.0
> npm --version
8.4.1
> mkdir npm-cli-4232-repro && cd npm-cli-4232-repro && git init && npm init -y
> npm install is-odd
> rg '\"version\"' ./node_modules
./node_modules\is-number\package.json
4:  "version": "6.0.0",

./node_modules\is-odd\package.json
4:  "version": "3.0.1",
> git add package*.json && git commit -m 'before override'

# Now edit package.json adding "overrides": { "is-number": "5.0.0" }

# Expected behavior: npm install should update the lockfile and installed versions such that the override to v5.0.0 is satisfied
> npm install
# Actual behavior: the installed version of is-number remains 6.0.0, not 5.0.0
> rg '\"version\"' ./node_modules
./node_modules\is-number\package.json
4:  "version": "6.0.0",

./node_modules\is-odd\package.json
4:  "version": "3.0.1",
# Actual behavior: package-lock.json is only partially updated.
# A reviewer skimming the most obvious version number change will see that the is-odd requires section correctly indicates 5.0.0
# However, the is-number entry in dependencies is incorrectly still referencing 6.0.0
> git diff package-lock.json
diff --git a/package-lock.json b/package-lock.json
index 894fae9..2b7850b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -34,8 +34,7 @@
   },
   "dependencies": {
     "is-number": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-6.0.0.tgz",
+      "version": "https://registry.npmjs.org/is-number/-/is-number-6.0.0.tgz",
       "integrity": "sha512-Wu1VHeILBK8KAWJUAiSZQX94GmOE45Rg6/538fKwiloUu21KncEkYGPqob2oSZ5mUT73vLGrHQjKw3KMPwfDzg=="
     },
     "is-odd": {
@@ -43,7 +42,7 @@
       "resolved": "https://registry.npmjs.org/is-odd/-/is-odd-3.0.1.tgz",
       "integrity": "sha512-CQpnWPrDwmP1+SMHXZhtLtJv90yiyVfluGsX5iNCVkrhQtU3TQHsUWPG9wkdk9Lgd5yNpAg9jQEo90CBaXgWMA==",
       "requires": {
-        "is-number": "^6.0.0"
+        "is-number": "5.0.0"
       }
     }
   }

Once the user is in this scenario, both package-lock.json and /node_modules/ must be deleted in order to get the correct behavior from npm install; if you delete either one but not the other, npm install will return you to the unexpected state.

(Node 16.14.0, npm 8.4.1, Windows 11 21H2 22000.493)

[cristianoccazinsp]

Overrides not working at all with npm 8.4.1, e.g.:

  "overrides": {
    "react-native": {
      "hermes-engine": "~0.11.0"
    }
  },