npm install vs npm ci for CI/CD dependency consistency

In automated integration pipelines, the choice between npm install and npm ci impacts build determinism and execution speed. npm install allows for automatic updates to the package-lock.json if ranges in package.json permit newer versions, which risks dependency drift where the CI environment differs from local development states.

Conversely, npm ci enforces a strict match with the lockfile, failing if the files are out of sync. While this ensures reproducible builds and bypasses the resolution logic, it requires a full deletion of the node_modules directory before execution, which may introduce overhead in projects with massive dependency trees.

The primary trade-off lies between the flexibility of incremental dependency updates versus the reliability and speed of a clean-state deterministic install.

• What is the specific performance overhead of the resolution phase in npm install for trees exceeding 5000 packages?
• How does npm ci handle peer dependency conflicts compared to npm install when the lockfile is manually modified?