3

I noticed a failing build on my CI, because I deleted the package-lock.json, because it seemed out of date anyway since I'm using pnpm. A proper package-lock.json does seem to be required though.

It's probably possible to run npm install --package-lock-only with a pre-push hook if the package.json was updated, but this takes a while and isn't very convenient.

Is there something I'm missing? I think this functionality should be built into pnpm to improve compatibility.

EDIT: I don't think switching to pnpm on my CI is an option, since I'm writing a library that I want people to be able to install using npm.

6
  • if you use pnpm then just commit pnpm's lockfile and build with pnpm on the CI server (pnpm.js.org/docs/en/continuous-integration.html). There is a command (pnpm import) for converting package-lock.json to shrinkwrap.yaml but no vice versa. Mar 4, 2019 at 13:10
  • @ZoltanKochan I don't really think this is an option and I'll update the question to explain why. Mar 4, 2019 at 13:43
  • Currently, pnpm is more strict than npm, so if your package will work with pnpm, it will work with both npm and Yarn. medium.com/pnpm/… Mar 4, 2019 at 18:34
  • @ZoltanKochan If npm and yarn would be using the shrinkwrap.yaml, which they aren't. This is evident from having used pnpm while developing and the build failing in the CI using npm. Mar 4, 2019 at 22:44
  • 2
    If you develop a library, not an app, then maybe just don't commit any lockfile. In that case, you're sure that you always get the very latest dependencies. This is how Sindre Sorhus maintains his libraries and he has thousands of libs on npm. Mar 5, 2019 at 13:53

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.