#1145405 node-cacache: Ships a file that's also shipped by the `npm' package

Package:
npm
Source:
npm
Submitter:
Gunnar Wolf
Date:
2026-08-24 19:25:02 UTC
Severity:
normal
#1145405#5
Date:
2026-08-24 16:27:20 UTC
From:
To:
Hello,

While updating my sid system, I got the following error message from dpkg:

    Preparing to unpack …/archives/npm_11.19.0-1_all.deb…
    Unpacking npm (11.19.0-1) over (11.16.0+ds2-4)…
    dpkg: error processing archive /var/cache/apt/archives/npm_11.19.0-1_all.deb (--unpack):
     trying to overwrite '/usr/share/nodejs/@npmcli/fs/lib/common/get-options.js', which is also in package node-cacache (20.0.4+~cs30.1.8-3)
    Errors were encountered while processing:
     /var/cache/apt/archives/npm_11.19.0-1_all.deb

While the message was given for npm, due to the file location, AFAICT the
file should be owned by npm, and the bug would be in node-cacache — but I
might be mistaken here, please reassign if deemed necessary!

Thanks,

 — Gunnar.
#1145405#8
Date:
2026-08-24 16:58:28 UTC
From:
To:
Hello,

Bug #1145405 in npm reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/npm/-/commit/0a10dbddcfdc70f8440cbb84435464bb044e0f53
npm 11.19.0-1 shipped an unrepacked orig tarball, so
node_modules/@npmcli/fs was installed in /usr/share/nodejs and
conflicted with the copy embedded in node-cacache.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1145405
#1145405#15
Date:
2026-08-24 17:04:50 UTC
From:
To:
Yadd dijo [Mon, Aug 24, 2026 at 04:58:28PM +0000]:

Thank you very much for the very quick reply!
#1145405#20
Date:
2026-08-24 17:04:50 UTC
From:
To:
Yadd dijo [Mon, Aug 24, 2026 at 04:58:28PM +0000]:

Thank you very much for the very quick reply!
#1145405#23
Date:
2026-08-24 17:04:50 UTC
From:
To:
Yadd dijo [Mon, Aug 24, 2026 at 04:58:28PM +0000]:

Thank you very much for the very quick reply!
#1145405#28
Date:
2026-08-24 17:15:14 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
npm, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145405@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated npm package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 24 Aug 2026 18:34:02 +0200
Source: npm
Binary: npm
Architecture: source all
Version: 11.19.0+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Description:
 npm        - package manager for Node.js
Closes: 1145405
Changes:
 npm (11.19.0+ds1-1) unstable; urgency=medium
 .
   * Team upload
   * Repack source to drop embedded node modules: previous upload shipped
     node_modules/@npmcli/fs, which is also in node-cacache (Closes: #1145405)
Checksums-Sha1:
 95c446676e8f78bff56c0fb3dc276c23be831251 2639 npm_11.19.0+ds1-1.dsc
 1d708e9c826d617662c650cdbe682072e7597a7d 68722112 npm_11.19.0+ds1.orig.tar.xz
 a956152df2cc8bc74eee782be835d2e8b3bf31b2 54020 npm_11.19.0+ds1-1.debian.tar.xz
 f5a4e760a028c9fabdb4f9293a98fe7ecb1485b1 906644 npm_11.19.0+ds1-1_all.deb
 3c29f6994b383ea0562005e9acc960f788d8535e 24506 npm_11.19.0+ds1-1_amd64.buildinfo
Checksums-Sha256:
 ae7431373d9344f6b1f5a47cdb9d4cc405f642b93e95f364be4283722fa65316 2639 npm_11.19.0+ds1-1.dsc
 75b6f18b0835f9fbeba9da35fe9045a95bb4eb1b315838200529421a52c23879 68722112 npm_11.19.0+ds1.orig.tar.xz
 ec93def2d3a5d3ec88278a4615407207a77108f67097fa6e43f1cabd8296f57f 54020 npm_11.19.0+ds1-1.debian.tar.xz
 98224951f3884ee8f0fffe1ee68d5dc76b14f22a55550ff06471bf70a9146e69 906644 npm_11.19.0+ds1-1_all.deb
 c3915e43f592e49970dbbe785660764d0c2749b247178f64b5cf498f5dc6673b 24506 npm_11.19.0+ds1-1_amd64.buildinfo
Files:
 3e6053d1bda4141942013071b74b9a86 2639 javascript optional npm_11.19.0+ds1-1.dsc
 a12b46189b927136a36aa40c5fdfcd57 68722112 javascript optional npm_11.19.0+ds1.orig.tar.xz
 75c16272afa6ef76044dbfccd116ea5d 54020 javascript optional npm_11.19.0+ds1-1.debian.tar.xz
 e86b197b4acffddf2801c4f38f83da0a 906644 javascript optional npm_11.19.0+ds1-1_all.deb
 eee62e2406be3cb96d7069cdff5447fa 24506 javascript optional npm_11.19.0+ds1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqMdN0ACgkQ9tdMp8mZ
7ulcMg/+Lcap9WrOZMkynuoTHiY8NrOJt3Mior5QoffwxR+nLZNj2OCkSiBy2Oqo
5lF00xGXygXXXp4XSyoLmLDF768S47ubu0BqFD4Bmy8+R2s35AlcHPQG1TuyZCol
GgpsE+5n5ccVUtq0WAVKtI7ZGgtUYZ/zPxWIpFsh82a9++K98BggpQppdVvgxr+C
FmtZIiKhyl7Z3V9dWdQMKONIkTMCR4s666IBFQ6X5cUzrUsTBsvFMXp1rFaeWM4e
6WowRttYL82sEgFkV1Sf5iR7pez35vyTwyatBEDsA0fIssVY4AohsEKMF6ftAhL6
XcVJ9n1u2r82/rAADxgkpMfAA1CKIS963h42JKIrjtRZH+xDwCHiPV/4hDQW/qTe
CiT2IveZ/wrKBGFax6nG/Pv6ExFbO8g1jqL84TNtBtNZItDHkIWX+yH/GYKmdlDq
UIE67YP2sb4p/UWZEpBB3ySay018zjHHqC16y+7e2xaklHiyzR1bk1Sugblrg9EO
0M7vyiG3RFpbVNtL0/XpiCpxopIi7768vL1BBUAYSW91rdzeYPvBzay4Jb04QrTL
0KnGxamzuQZ/GfeU6Z9Of4dmUaG7crSxH/38h80mm6hQNIAEsPXQNqOMY9bg/0WC
89QOdK6I9Z/hnhqF21GGpNiU8n24yGlyfudcnLVleIl3rkb3XJE=
=J3Tk
-----END PGP SIGNATURE-----
#1145405#45
Date:
2026-08-24 19:23:20 UTC
From:
To:
Le 24/08/2026 à 19:04, Gunnar Wolf a écrit :
didn't repack!