LinuxCommandLibrary

package-lock.json

TLDR

Generate/update lock file

$ npm install
copy
Clean install from lock file
$ npm ci
copy
Update specific package
$ npm update [package]
copy
View lock file diff
$ git diff package-lock.json
copy

SYNOPSIS

package-lock.json - npm dependency lock file

DESCRIPTION

package-lock.json is automatically generated by npm to lock dependency versions. It records the exact version of every installed package and its dependencies, ensuring reproducible builds.
The file should be committed to version control to ensure consistent installs across environments.

KEY FIELDS

$ {
  "name": "my-project",
  "lockfileVersion": 3,
  "packages": {
    "": { "dependencies": {...} },
    "node_modules/lodash": {
      "version": "4.17.21",
      "resolved": "https://registry.npmjs.org/...",
      "integrity": "sha512-..."
    }
  }
}
copy

LOCK FILE VERSIONS

$ v1 - npm 5-6
v2 - npm 7+ (backwards compatible)
v3 - npm 7+ (optimized)
copy

CAVEATS

Don't edit manually. Commit to git. Use npm ci for CI builds. Conflicts common in merges.

HISTORY

package-lock.json was introduced in npm 5 (2017) to address reproducibility issues, replacing npm-shrinkwrap.json for most use cases.

SEE ALSO

npm(1), npm-ci(1), yarn.lock(5)

Copied to clipboard