Update: OP wound up needing to make use of yarn
which their team and project made use of. If anyone finds a yarn.lock
in their project root, this is an indication that yarn
is involved and any package-lock.json
, if there is one, is possibly outdated.
TL;DR: it sounds like the package-lock.json
needs some updates and resolution, which is done primarily with npm install
.
It sounds like the package-lock.json
no longer "agrees" with your package.json
. It also sounds like others on your team are avoiding committing the changes to your package-lock.json
; this is a bad practice in my experience as it only deepens any divergence in their contents. Over time they can be out of sync when dependencies of dependencies may publish a bug fix release and potentially un-publish a previous version.
As a junior dev on this team, I would bring this up to your development/team lead and ask their preferred approach here. If there was a major dependency intentionally removed and that has a lot of its own dependencies, it could cause a large removal of lines from package-lock.json
and look severe to one less accustomed to it.
Extra context:
During an install, npm installs the dependencies and development dependencies listed in your package.json
. In the process it's possible and increasingly likely over time, that some of the dependencies of those dependencies, which are needed to execute, will overlap and often with conflicting versions. The execution of npm i(nstall)
will attempt to reconcile all these competing versions of sub-dependencies for you.
In a Continuous Integration context, it is desirable for the alternate command npm ci
to be used, which explicitly installs only what's resolved already, from package-lock.json
(the formerly known as "shrinkwrap"). This is meant to reduce the "but it works on my machine!" moments. As a developer, I've found it to be preferable to use npm install
, as this alerts the developers more quickly to any dependency resolution issues and keeps the package-lock.json
up to date.