[BUG] `npm install` ignores tag/branch changes to git dependencies in package.json

[Kakadus]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Changing the tag or branch of a git dependency in package.json and running npm i does not update the lockfile nor node_modules.

When the dependency is declared using the semver:xxx or commit sha spec, the update does work correctly. As another workaround, removing the resolved and version lines from the package-lock forces npm to re-resolve the dependency.

Similar to issue reported in #5170 (comment) (the issue itself is about caching though).
#3427 concerned updating by running npm i <spec> which was fixed. This is about editing package.json and running plain npm i to update.

Expected Behavior

The new tag or branch should be resolved correctly, updating package-lock and node_modules accordingly.

Steps To Reproduce

1. package.json:

   {
    "name": "repro",
     "version": "1.0.0",
     "dependencies": {
       "uWebSockets.js": "uNetworking/uWebSockets.js#v20.51.0"
     }
   }

2. npm i installs v20.51.0 correctly
3. change package.json to

   {
     "name": "repro",
     "version": "1.0.0",
     "dependencies": {
       "uWebSockets.js": "uNetworking/uWebSockets.js#v20.67.0"
     }
   }

4. npm i prints "up to date"
5. cat node_modules/uWebSockets.js/package.json | grep '"version"' && echo '---lockfile---' && grep -A2 'node_modules/uWebSockets' package-lock.json shows the old versions in the node_modules and lockfile.

     "version": "20.51.0",
   ---lockfile---
       "node_modules/uWebSockets.js": {
         "version": "20.51.0",
         "resolved": "git+ssh://git@github.com/uNetworking/uWebSockets.js.git#6609a88ffa9a16ac5158046761356ce03250a0df",
   

Expected would be "changed 1 package" in 4. and

"version": "20.67.0",
---lockfile---
    "node_modules/uWebSockets.js": {
      "version": "20.67.0",
      "resolved": "git+ssh://git@github.com/uNetworking/uWebSockets.js.git#e0f56ebb4b349017f006e14d1cd29052f2a7121d",

in 5.

Environment

• npm: 11.16.0 as well as a105799 (current latest)
• Node.js: v26.2.0
• OS Name: Linux
• System Model Name: n/a
• npm config:

package-lock = true