[BUG] Exclusive configuration for `--prefer-online` and `--prefer-offline` breaks git dependency preparation flow

[g-wn]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

In the latest version of NPM (11.12.0), there appears to be a regression with config validation.

This command works in npm@11.10.0 and npm@11.11.0, but fails in npm@11.12.0:

npm install \
  --prefer-offline=true \
  --prefer-online=false \
  --package-lock-only \
  --ignore-scripts \
  --no-audit \
  --no-fund

Error:

Exit prior to config file resolving
cause
--prefer-online cannot be provided when using --prefer-offline

This breaks NPM's git dependency preparation flow, because pacote generates nested install commands with both --prefer-offline=<bool> and --prefer-online=<bool>. I noticed exclusivity was introduced here.

Expected Behavior

If a clean install finds a dependency that triggers the git dependency preparation flow, it should not throw an error from the generated config/flags in pacote.

Steps To Reproduce

1. Using npm@11.12.0
2. Run npm install --prefer-offline=true --prefer-online=false --package-lock-only --ignore-scripts --no-audit --no-fund
3. See error: --prefer-online cannot be provided when using --prefer-offline

Environment

• npm: 11.12.0
• Node.js: 22.22.0
• OS Name: MacOS Tahoe 26.3.1
• System Model Name: Macbook Pro

[danielweck]

We're affected too!

[MorningLightMountain713]

Yup - broke our tooling also

[E5-Aaron]

We ran into this inside a node:24-alpine container where we were (probably too bravely) using npm i -g npm@latest and exploded our build.

[Daniel2tio]

Also having this issue after upgrading

[zachleat]

This one is breaking publishing workflows via GitHub Actions, fwiw.

[ehoogeveen-medweb]

To be clear (because it wasn't to me): This makes npm ci fail when there's a git-based dependency in package-lock.json.

In our case, we're using @vue/language-server version 3.0.10 for Vue 2 support, which depends on @emmetio/css-parser version 0.4.0 from git+ssh://git@github.com/ramya-rao-a/css-parser.git#370c480ac103bd17c7bcfb34bf5d577dc40d3660.

After updating to npm version 11.12.0, npm ci calls npm-cli.js install --force --cache=/home/user/.npm --prefer-offline=false --prefer-online=false --offline=false --no-progress --no-save --no-audit --include=dev --include=peer --include=optional --no-package-lock-only --no-dry-run which fails with the mentioned error.

We're not explicitly passing --prefer-online or --prefer-offline - I didn't even know about the existence of these flags. They get passed internally and cause things to break.