Do I need both package-lock.json and package.json?
After updating my NPM to the latest version (from 3.X to 5.2.0) and running npm install on an existing project, I get an auto-created package-lock.json file.
I can tell package-lock.json gives me an exact dependency tree as opposed to package.json.
From that info alone, it seems like package.json is redundant and not needed anymore.
Are both of them necessary for NPM to work?
Is it safe or possible to use only the package-lock.json file?
The docs on package-lock.json (doc1, doc2) doesn't mention anything about that.
Edit:
After some more thinking about it, I came to the conclusion that if someone wants to use your project with an older version of NPM (before 5.x) it would still install all of the dependencies, but with less accurate versions (patch versions)
Do you need both package-lock.json and package.json? No.
Do you need the package.json? Yes.
Can you have a project with only the package-lock.json? No.
The package.json is used for more than dependencies - like defining project properties, description, author & license information, scripts, etc. The package-lock.json is solely used to lock dependencies to a specific version number.
package-lock.json: records the exact version of each installed package which allows you to re-install them. Future installs will be able to build an identical dependency tree.
package.json: records the minimum version you app needs. If you update the versions of a particular package, the change is not going to be reflected here.
package.json records the minimum version needed by the app and package-lock.json records the exact version of each installed package, then I'm having a strange situation where a module is set at version 0.112.1 in package.json and 0.110.0 in package-lock.json...
Package.json vs Package.lock.json
https://i.stack.imgur.com/pSzRD.png
https://i.stack.imgur.com/CnIxx.png
If your question is if lock file should be committed to your source control - it should. It will be ignored under certain circumstance.
I found it bloating pull requests and commit history, so if you see it change, do a separate commit for it.
package-lock.json seems like a more verbose version of package.json, so is it safe or possible to use only the lock file.
package-lock.json under version control.
A more accurate and detailed explanation of the reason behind keeping package-lock.json can be found here
Follow WeChat
Success story sharing
Want to stay one step ahead of the latest teleworks?
Subscribe Now相似问题
- Is there a way to get version from package.json in nodejs code?
- Find the version of an installed npm package
- How to update each dependency in package.json to the latest version?
- How to install an npm package from GitHub directly
- What's the difference between dependencies, devDependencies and peerDependencies in npm package.json file?
- What's the difference between tilde(~) and caret(^) in package.json?
- Do I commit the package-lock.json file created by npm 5?
- Why does "npm install" rewrite package-lock.json?
package-lock.js- refer to docs.npmjs.com/cli/v8/commands/npm-ci