What is the difference between npm-shrinkwrap.json and package-lock.json?

by

The files have exactly the same content, but there are a handful of differences in how npm handles them, most of which are noted on the docs pages for package-lock.json and npm-shrinkwrap.json:

  • package-lock.json is never published to npm, whereas npm-shrinkwrap is by default
  • package-lock.json files that are not in the top-level package are ignored, but shrinkwrap files belonging to dependencies are respected
  • npm-shrinkwrap.json is backwards-compatible with npm versions 2, 3, and 4, whereas package-lock.json is only recognized by npm 5+

You can convert an existing package-lock.json to an npm-shrinkwrap.json by running npm shrinkwrap.

Thus:

  • If you are not publishing your package to npm, the choice between these two files is of little consequence. You may wish to use package-lock.json because it is the default and its name is clearer to npm beginners; alternatively, you may wish to use npm-shrinkwrap.json for backwards compatibility with npm 2-4 if it is difficult for you to ensure everyone on your development team is on npm 5+. (Note that npm 5 was released on 25th May 2017; backwards compatibility will become less and less important the further we get from that date, as most people will eventually upgrade.)

  • If you are publishing your package to npm, you have a choice between:

    1. using a package-lock.json to record exactly which versions of dependencies you installed, but allowing people installing your package to use any version of the dependencies that is compatible with the version ranges dictated by your package.json, or
    2. using an npm-shrinkwrap.json to guarantee that everyone who installs your package gets exactly the same version of all dependencies

    The official view described in the docs is that option 1 should be used for libraries (presumably in order to reduce the amount of package duplication caused when lots of a package’s dependencies all depend on slightly different versions of the same secondary dependency), but that option 2 might be reasonable for executables that are going to be installed globally.

More Related Contents:

  1. Do I need both package-lock.json and package.json?
  2. Pass command line args to npm scripts in package.json
  3. What is the role of the package-lock.json?
  4. What is the difference between “npm install” and “npm ci”?
  5. Message “npm WARN config global `–global`, `–local` are deprecated. Use `–location=global` instead”
  6. how to install multiple versions of package using npm
  7. Field ‘browser’ doesn’t contain a valid alias configuration
  8. Deleting `package-lock.json` to Resolve Conflicts quickly
  9. How do I correctly upgrade angular 2 (npm) to the latest version?
  10. How to fix SSL certificate error when running Npm on Windows?
  11. Browserslist: caniuse-lite is outdated. Please run next command `npm update caniuse-lite browserslist`
  12. Npm audit fix –force react script downgrade automatically
  13. On npm install: Unhandled rejection Error: EACCES: permission denied
  14. Error ‘tunneling socket’ while executing npm install
  15. npm equivalent of yarn resolutions?
  16. create-react-app dependency version issues with React 18
  17. Difference between npm start and npm run start
  18. How do I fix a vulnerable npm package in my package-lock.json that isn’t listed in the package.json?
  19. Is there any way to fix package-lock.json lockfileVersion so npm uses a specific format?
  20. How can I reference package version in npm script?
  21. How to fix EACCES issues with npm install
  22. Error in starting hyperledger fabric network with hyperledger composer
  23. How to view the dependency tree of a given npm module?
  24. How do I override nested dependencies with `yarn`?
  25. What does “npm audit fix” exactly do?
  26. Running Mocha 6 ES6 tests with Babel 7, how to set up?
  27. Is there a difference between `npm start` and `npm run start`?
  28. webpack is not recognized as a internal or external command,operable program or batch file
  29. How to solve npm install error “npm ERR! code 1”
  30. How to avoid React loading twice with Webpack when developing

Leave a Comment