Repair malformed lockfile entries causing npm install to fail with Invalid Version

[Copilot]

npm install was failing immediately with Invalid Version: due to malformed nested entries in package-lock.json. The lockfile contained package nodes without required version metadata, which breaks npm/arborist semver handling during dedupe.

• Root cause

  • Two nested lockfile package entries were present with incomplete metadata (optional/dev only), leaving version effectively empty for npm’s resolver path.

• Lockfile metadata repair

  • Added complete metadata for:
    • node_modules/@img/sharp-wasm32/node_modules/@emnapi/runtime
    • node_modules/minipass-fetch/node_modules/encoding
  • Restored required fields: version, resolved, integrity, and license.

• Representative change

  "node_modules/minipass-fetch/node_modules/encoding": {
    "version": "0.1.13",
    "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
    "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
    "license": "MIT",
    "dev": true,
    "optional": true
  }

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

[kilo-code-bot]

WARNING: @emnapi/core should not have "peer": true — it is an optional build-time dependency of sharp, not a peer dependency. This misclassification could confuse npm's dependency resolution and bundlers.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

WARNING: @emnapi/runtime should not have "peer": true — it is an optional build-time dependency of sharp, not a peer dependency. Additionally, this entry is missing "dev": true, which should be present since it is a development/build dependency.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

WARNING: @emnapi/wasi-threads should not have "peer": true — it is an optional build-time dependency of sharp, not a peer dependency.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

WARNING: @next/env should not have "peer": true — it is a direct dependency of next, not a peer dependency. Adding peer: true incorrectly marks it as a peer dependency.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

WARNING: next should not have "peer": true — it is a direct dependency of the project, not a peer dependency. Adding peer: true incorrectly marks it as a peer dependency.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

Code Review Summary

Status: 5 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	5
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
package-lock.json	1050	@emnapi/core incorrectly has "peer": true — it is an optional build-time dependency of sharp, not a peer dependency
package-lock.json	1062	@emnapi/runtime incorrectly has "peer": true (should not be a peer dep) and is missing "dev": true (it is a dev/build dependency)
package-lock.json	1074	@emnapi/wasi-threads incorrectly has "peer": true — it is an optional build-time dependency of sharp, not a peer dependency
package-lock.json	2367	@next/env incorrectly has "peer": true added — it is a direct dependency of next, not a peer dependency
package-lock.json	11675	next incorrectly has "peer": true added — it is a direct project dependency, not a peer dependency

Files Reviewed (1 files)

• package-lock.json - 5 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by ling-3.0-flash:free · Input: 334.9K · Output: 19.5K · Cached: 6.3M}