Why does “npm install” rewrite package-lock.json?

by

Update 3: As other answers point out as well, the npm ci command got introduced in npm 5.7.0 as additional way to achieve fast and reproducible builds in the CI context. See the documentation and npm blog for further information.

Update 2: The issue to update and clarify the documentation is GitHub issue #18103.

Update 1: The behaviour that was described below got fixed in npm 5.4.2: the currently intended behaviour is outlined in GitHub issue #17979.

Original answer: The behaviour of package-lock.json was changed in npm 5.1.0 as discussed in issue #16866. The behaviour that you observe is apparently intended by npm as of version 5.1.0.

That means that package.json can override package-lock.json whenever a newer version is found for a dependency in package.json. If you want to pin your dependencies effectively, you now must specify the versions without a prefix, e.g., you need to write them as 1.2.0 instead of ~1.2.0 or ^1.2.0. Then the combination of package.json and package-lock.json will yield reproducible builds. To be clear: package-lock.json alone no longer locks the root level dependencies!

Whether this design decision was good or not is arguable, there is an ongoing discussion resulting from this confusion on GitHub in issue #17979. (In my eyes it is a questionable decision; at least the name lock doesn’t hold true any longer.)

One more side note: there is also a restriction for registries that don’t support immutable packages, such as when you pull packages directly from GitHub instead of npmjs.org. See this documentation of package locks for further explanation.

More Related Contents:

  1. How to solve npm error “npm ERR! code ELIFECYCLE”
  2. NPM Install Error:Unexpected end of JSON input while parsing near ‘…nt-webpack-plugin”:”0’
  3. npm install error – unable to get local issuer certificate
  4. npm ERR! Error: connect ECONNREFUSED when trying to update the npm
  5. npm install – javascript heap out of memory
  6. npm: When to use `–force` and `–legacy-peer-deps`
  7. Why does `package-lock.json` causes a failure in a docker container build when `npm install`?
  8. How do I fix a vulnerable npm package in my package-lock.json that isn’t listed in the package.json?
  9. Is there any way to fix package-lock.json lockfileVersion so npm uses a specific format?
  10. npm ERR! git dep preparation failed when trying to install package.json
  11. how to specify local modules as npm package dependencies
  12. NPM global install “cannot find module”
  13. How to include scripts located inside the node_modules folder?
  14. How can I make multiple projects share node_modules directory?
  15. Command to remove all npm modules globally
  16. ‘node’ is not recognized as an internal or an external command, operable program or batch file while using phonegap/cordova
  17. How can I uninstall npm modules in Node.js?
  18. Can’t run my Node.js Typescript project TypeError [ERR_UNKNOWN_FILE_EXTENSION]: Unknown file extension “.ts” for /app/src/App.ts
  19. npm check and update package if needed
  20. How to add custom certificate authority (CA) to nodejs
  21. How to resolve Nodejs: Error: ENOENT: no such file or directory
  22. Use a node module from casperjs
  23. What does -save-dev mean in npm install grunt –save-dev
  24. npm install shows error with git not found
  25. npm install not work
  26. npm: Why is a version “0.1” invalid?
  27. How to organise file structure of backend and frontend in MERN
  28. npm doesn’t work, get always this error -> Error: Cannot find module ‘are-we-there-yet’
  29. What’s the difference between dependencies, devDependencies, and peerDependencies in NPM package.json file?
  30. Getting 404 when attempting to publish new package to NPM

Leave a Comment