11

If i manually add a package to package.json and then run npm install, my package-lock.json gets updated with that new package's dependencies.

However, if i then manually delete that package from package.json from npm install, that package's dependencies are not removed from package-lock.json.

So - package-lock.json only gets modified when adding/updating packages in package.json? Not when removing?

4
  • By manually deleting, you mean you edit the file ? Sep 24, 2020 at 5:02
  • @DelwynPinto yes, manually editing package.json
    – Gambit2007
    Sep 24, 2020 at 5:03
  • Try npm prune
    – Phil
    Sep 24, 2020 at 5:04
  • 2
    @Phil that doesn't work unfortunately. I know a solution is to just remove package-lock.json and run npm install, but i'm not really looking for a solution - i'm looking for an understanding: why package-lock.json doesn't get updated?
    – Gambit2007
    Sep 24, 2020 at 5:12

3 Answers 3

8

This is a known issue with npm.

See issue :package-lock.json file not updated after package.json file is changed

" For now I'm working around it by changing my npm install command to rm -f package-lock.json && npm install. Obviously, that's not an elegant solution, and somewhat defeats the purpose of having a lockfile in the first place."

rm -f package-lock.json && npm install

This is supposed to be fixed in : https://github.com/npm/npm/pull/17508

See article : https://medium.com/coinmonks/everything-you-wanted-to-know-about-package-lock-json-b81911aa8ab8 for a better understanding.

1
  • 5
    All of this info is from 3 years ago.. so wasn't this supposed to be fixed?
    – Gambit2007
    Sep 24, 2020 at 7:46
1

Removal of package-lock.json should be only done in case of corrupted lock file. To remove package you should just use npm cli (it will update lock file)

npm uninstall <package>

This is a good explanation. https://stackoverflow.com/a/54127283/5040275

-1

From the NodeJs docs

The package-lock.json sets your currently installed version of each package in stone, and npm will use those exact versions when running npm install.

NPM by default will read the package-lock.json file.

Therefore, in the first scenario, npm is reading the package entry from package.json since that's the only file which has an entry of the particular package. Whereas in the second scenario, it is reading it from package-lock.json, as is its default behaviour

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.