Azure Devops: The given cache key has changed in its resolved value between restore and save steps;

I am struggling with one warning which shows in Azure Devops.

##[warning]The given cache key has changed in its resolved value between restore and save steps;
original key: npm|"Linux"|1hQ5erTp1F2VHRtmwbSGxyt5NqLK6CNbXboa/qqfKiE=
modified key: npm|"Linux"|ckttYS61PMovYKX4+92Nb7dvktCebx236/7P4XqXK6Q=

I don't know which step in yaml file would still touch package-lock.json.

DevOps uses following versions of nodejs and npm

Found tool in cache: node 16.13.2 x64
/opt/hostedtoolcache/node/16.13.2/x64/bin/npm --version
8.1.2

My machine

node -v
v16.13.1
npm -v
8.3.0

Any thoughts?

Thanks

Yaml

trigger:
- master
- develop
- features/*
- hotfix/*

pool:
  vmImage: ubuntu-latest
variables:
  NPM_CONFIG_CACHE: $(Pipeline.Workspace)/.npm
  disable.coverage.autogenerate: 'true'

steps:
- task: gitversion/setup@0
  displayName: "Setup Git versioning"
  inputs:
    versionSpec: '5.x'

- task: gitversion/execute@0
  displayName: "Execute Git versioning"
  inputs:
    useConfigFile: true
    configFilePath: 'GitVersion.yml'

- script: |
    echo '##vso[task.setvariable variable=buildVersion]$(GitVersion.FullSemVer)'
  displayName: 'Set build version variable'
 
- task: NodeTool@0
  displayName: 'Install Node.js'
  inputs:
    versionSpec: '16.x'

- task: Cache@2
  displayName: 'Restore NPM cache'
  inputs:
    key: 'npm | "$(Agent.OS)" | package-lock.json'
    restoreKeys: |
       npm | "$(Agent.OS)"
    path: $(NPM_CONFIG_CACHE)

- task: Npm@1
  displayName: 'NPM install'
  inputs:
    command: 'custom'
    customCommand: 'ci'

- task: Npm@1
  displayName: 'Lint'
  inputs:
    command: 'custom'
    workingDir: '$(Build.SourcesDirectory)'
    customCommand: 'run lint'

- task: Npm@1
  displayName: 'Build'
  inputs:
    command: 'custom'
    workingDir: '$(Build.SourcesDirectory)'
    customCommand: 'run build'

- task: Npm@1
  displayName: "Run unit tests"
  inputs:
    command: 'custom'
    workingDir: '$(Build.SourcesDirectory)'
    customCommand: 'run test:ci'

- task: Npm@1
  inputs:
    command: 'custom'
    workingDir: '$(Build.SourcesDirectory)'
    customCommand: 'version $(buildVersion) --no-git-tag-version'
  displayName: "Add version"

- task: Npm@1
  displayName: 'Publish to feed'
  inputs:
    command: 'publish'
    publishRegistry: 'useFeed'
    publishFeed: 'c63597a4-6555-4a12-a8dd-0a2a5a0fefe3/afac8330-979d-45e8-a168-8c0a2ed47ac4'

package-lock.json

{
    "name": "test",
    "version": "0.1.0",
    "lockfileVersion": 2,
    "requires": true,
    "packages": {
        ...
     }
}

After investigation, the step which invokes commands npm version $(buildVersion) --no-git-tag-version was touching package-lock.json

I added additional step which resets the version after Publish to feed

- task: Npm@1
  displayName: 'Reset version'
  inputs:
    command: 'custom'
    workingDir: '$(Build.SourcesDirectory)'
    customCommand: 'version 0.1.0 --no-git-tag-version'