Do I commit the package-lock.json file created by npm 5?

node.js git npm version-control lockfile
rink.attendant.6 picture rink.attendant.6 · May 26, 2017 · Viewed 547.7k times · Source

npm 5 was released today and one of the new features include deterministic installs with the creation of a package-lock.json file.

Is this file supposed to be kept in source control?

I'm assuming it's similar to yarn.lock and composer.lock, both of which are supposed to be kept in source control.

Answer

vine77 picture vine77 · May 27, 2017

Yes, package-lock.json is intended to be checked into source control. If you're using npm 5+, you may see this notice on the command line: created a lockfile as package-lock.json. You should commit this file. According to npm help package-lock.json:

package-lock.json is automatically generated for any operations where npm modifies either the node_modules tree, or package.json. It describes the exact tree that was generated, such that subsequent installs are able to generate identical trees, regardless of intermediate dependency updates.

This file is intended to be committed into source repositories, and serves various purposes:

  • Describe a single representation of a dependency tree such that teammates, deployments, and continuous integration are guaranteed to install exactly the same dependencies.

  • Provide a facility for users to "time-travel" to previous states of node_modules without having to commit the directory itself.

  • To facilitate greater visibility of tree changes through readable source control diffs.

  • And optimize the installation process by allowing npm to skip repeated metadata resolutions for previously-installed packages.

One key detail about package-lock.json is that it cannot be published, and it will be ignored if found in any place other than the toplevel package. It shares a format with npm-shrinkwrap.json, which is essentially the same file, but allows publication. This is not recommended unless deploying a CLI tool or otherwise using the publication process for producing production packages.

If both package-lock.json and npm-shrinkwrap.json are present in the root of a package, package-lock.json will be completely ignored.

Related questions

Should "node_modules" folder be included in the git repository

I'm wondering if we should be tracking node_modules in our repo or doing an npm install when checking out the code?

Read More
Should I check in node_modules to git when creating a node.js app on Heroku?

I followed the basic getting started instructions for node.js on Heroku here: https://devcenter.heroku.com/categories/nodejs These instruction don't tell you to create a .gitignore node_modules, and therefore imply that node_modules should be checked in …

Read More
update package.json version automatically

Before I do a small release and tag it, I'd like to update the package.json to reflect the new version of the program. Is there a way to edit the file package.json automatically? Would using a git pre-release …

Read More