Pin an npm that can resolve the AgentMemory image

[YellowSnnowmann]

Summary

• AgentMemory E2E is red on every branch including main. This makes it green.
• The image's bundled npm cannot resolve the AgentMemory package.json; a newer npm resolves the identical file fine.
• One line in the compose file's inline Dockerfile.

Problem

The job went green at b645372 (10:47) and red at cb58afb (15:39) the same day. cb58afb is the merge of #85, which touches no JavaScript, no Dockerfile and no compose file — and every PR branch fails it too.

The failure is in the container build, before anything from this repo runs:

#9 [4/6] RUN npm install
#9 5.939 npm error Cannot read properties of null (reading 'edgesOut')
#9 5.941 npm notice New major version of npm available! 10.9.8 -> 12.0.2

edgesOut on null is an npm arborist bug, and the log names the version: 10.9.8, what node:22-bookworm-slim ships.

Root cause, checked rather than assumed

I pulled package.json from the pinned tag (rohitg00/agentmemory@v0.9.29) and ran it against a newer npm:

$ npm install --dry-run --no-audit --no-fund # npm 11.12.1
added 276 packages in 47s # exit 0

So the dependency graph is resolvable. It is the npm version that cannot resolve it.

Two theories I checked and dropped, since they would have sent the next person the wrong way:

• Workspaces.COPY package.json before COPY . is the classic workspaces-break-on-manifest-only-copy shape. This package.json declares no workspaces, so that is not it.
• A bad dependency publish. Plausible from the timing, but npm 11 resolving the same graph rules it out as the cause — a publish is at most what moved the graph into the shape 10.9.8 mishandles.

The overrides block (qs, ws, protobufjs) is the most likely thing arborist is tripping on, but the fix does not depend on which edge it is.

Solution

 COPY package.json .
-RUN npm install+RUN npm install -g npm@11.12.1 && npm install

Pinned exactly, not floated. The reason this broke without a commit is that the build has no lockfile and resolves against a registry that moves underneath it; a floating npm@11 would leave half that non-determinism in place. 11.12.1 is the version I actually verified, rather than the 12.0.2 the notice advertises and I have not run.

What this does not fix. The upstream tag ships no lockfile, so npm ci is not available. That is the real fix and it is not ours to make — this build will stay exposed to registry drift, just not to this particular npm bug.

Testing

I cannot run this job locally (no Docker on this machine), so the honest statement of evidence is:

• Verified: npm 11.12.1 resolves the exact package.json from the pinned tag, exit 0, 276 packages.
• Verified: CI's failing npm is 10.9.8, from the job log itself.
• Not verified locally: npm 11.12.1 insidenode:22-bookworm-slim on linux. Close, not identical — CI is the test.

If it does not go green, the next thing to try is node:24-bookworm-slim (the tag's engines is node >=20.0.0, so the base image can move).

Related

Unblocks #86 and every other open PR in this repo. Independent of both — it is filed separately rather than folded into #86 because it shares no subject with it.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 07f487e8-2836-414e-8975-a5e46f60b6af

Warning

Your free Security trial is over. An organization admin can activate billing to continue.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out · 72 embedded · openrouter/openai/text-embedding-3-small