[geekyNads]

Fixes #11747

Problem

packages/browser-pool/package.json requires playwright@1.62.1 and @types/node@^26, but package-lock.json retained stale nested overrides from before that manifest was bumped: playwright@1.61.1 and @types/node@22.20.1. These don't satisfy the workspace's own specs, so Arborist treats the locked placement as invalid.

Online npm install masks this by silently re-resolving the mismatched subtree. Cache-only/offline installs (npm ci --offline, Docker builds with a pre-warmed lock cache, Nix's buildNpmPackage) correctly refuse to trust the stale lock and try to hit the registry for the real versions — failing with ENOTCACHED when no network is available.

Fix

Removed the stale packages/browser-pool/node_modules/{playwright,@types/node,undici-types} entries from package-lock.json and regenerated with npm install --package-lock-only. No nested override is needed at all — root already resolves playwright@1.62.1 / @types/node@26.2.0, and browser-pool's ranges are compatible, so it now hoists cleanly to those.

Scanned both workspaces (open-sse, packages/browser-pool) for any other manifest/lockfile drift — none found; this was isolated to the one workspace.

Diff

package-lock.json: 13 insertions, 98 deletions. No production code changed.

Testing

• npm ci --ignore-scripts --cache <cache> --offline against a cache warmed exclusively from the corrected lockfile: exit 0, full monorepo (2,434 packages), no registry hits — this is the exact cache-only reproduction from the issue
• playwright resolves to 1.62.1, @types/node resolves to 26.2.0, both hoisted to root with no nested overrides under packages/browser-pool/node_modules
• npm run lint: exit 0, clean

Checklist

• Tests pass (no production code changed, no new tests needed)
• Linting passes
• Changelog fragment added: changelog.d/fixes/11747-browser-pool-lockfile-sync.md
• No hardcoded secrets or fallback values
• SonarQube (pending CI)