[BUG] `npm install` ignores Git SHA changes

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

Changing a Git dependency’s full commit SHA in package.json, then running npm install, leaves the old commit in both package-lock.json and node_modules. The command succeeds and reports that everything is up to date.

Expected Behavior

npm install should detect that the requested commit differs from the locked commit, install the requested commit, and update package-lock.json.

Steps To Reproduce

This example uses two sibling directories: dependency contains a Git package with two commits, and consumer installs that package. Run the commands in the same Bash session.

1. Create the dependency and its two commits.

   Both commits have the same package version but different file contents.

   bash复制

   mkdir git-dependency-update-test
   cd git-dependency-update-test
   mkdir dependency consumer
   
   cd dependency
   git init
   echo '{"name":"dependency","version":"1.0.0"}' > package.json
   
   echo 'old content' > content.txt
   git add .
   git commit -m "Old content"
   old_commit=$(git rev-parse HEAD)
   
   echo 'new content' > content.txt
   git commit -am "New content"
   new_commit=$(git rev-parse HEAD)
   
   dependency_url="git+file://$PWD"

2. Install the old commit in the consumer.

   bash复制

   cd ../consumer
   npm init -y
   npm config set allow-git=all --location=project
   npm install "dependency@$dependency_url#$old_commit"

3. Change package.json to request the new commit, then run npm install.

   bash复制

   npm pkg set "dependencies.dependency=$dependency_url#$new_commit"
   npm install

4. Check the installed content.

   bash复制

   cat node_modules/dependency/content.txt

   Expected: new content
   Actual: old content

   package-lock.json also retains the old commit’s SHA.

Environment

• npm: 12.0.2 (also reproduced on 11.16.0 and 10.9.8)
• Node.js: v24.18.0
• OS Name: LimeOS 0.7.0 (Debian-based, kernel 6.12.94+deb12-amd64)
• System Model Name: ROG Zephyrus G14 GA403UV_GA403UV 1.0
• npm config ls:

; "user" config from /home/user/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; node bin location = /home/user/.nvm/versions/node/v24.18.0/bin/node
; node version = v24.18.0
; npm local prefix = /home/user/Workspace/(redacted)
; npm version = 12.0.2
; cwd = /home/user/Workspace/(redacted)
; HOME = /home/user
; Run `npm config ls -l` to show all defaults.