Dependabot or Renovate pull requests fail CI because the lockfile is out of date (npm ci: package.json and package-lock.json are not in sync). How do I fix it?

Cause: npm ci never rewrites the lockfile. If the dependencies recorded in package-lock.json do not match package.json, it exits with an error instead of updating, as npm install would. Bot PRs hit this when the bot edited package.json but could not regenerate the lockfile consistently, when the lockfile was produced by a different npm major version, or when it was generated with flags that change the tree (such as --legacy-peer-deps or --install-links) that CI does not pass. Fix: 1. Check out the bot branch, run "npm install" with the same Node and npm versions CI uses (pin them via engines, .nvmrc or setup-node), and commit the updated package-lock.json. 2. Use the same flags locally and in CI: if the lockfile was created with --legacy-peer-deps, pass it to npm ci too, or set it in .npmrc. 3. For private registries, give the bot access (Dependabot registries config or Renovate hostRules) so it can resolve packages and rewrite the lockfile; otherwise it may leave it stale. 4. In Renovate, review postUpdateOptions (e.g. npmDedupe) and lockFileMaintenance, and let Renovate rebase the PR after you change settings. Dependabot recreates a PR when you comment "@dependabot rebase". 5. Keep Dependabot's own secrets and token scope in mind: workflows triggered by Dependabot run with a read-only token and only Dependabot secrets, so steps needing other secrets fail for a different reason. 6. Do not replace npm ci with npm install in CI just to make it pass; you lose reproducibility. Verify: "npm ci" succeeds locally on the PR branch and the CI job passes after the bot rebases. Sources: https://docs.npmjs.com/cli/v10/commands/npm-ci https://docs.github.com/en/code-security/dependabot/troubleshooting-dependabot/troubleshooting-dependabot-on-github-actions https://docs.renovatebot.com/configuration-options/