CODEWITHSUNDEEP
npmnode-modulespackage.jsonpackage-lock.json
Mobiletainment
Mobiletainment

Reputation: 23261

npm5 package-lock.json different entries on different machines

Our project uses npm for package management. After upgrading from npm 4 to npm 5, we decided to opt-in for the new package-lock.json.

After committing it and performing npm install on other machines, we spotted differences in the way the version and resolved entries are specified:

1) example of package-lock.json dependencies with version encoded as URL:

"jspm": {
  "version": "https://registry.npmjs.org/jspm/-/jspm-0.16.52.tgz",
  "integrity": "sha1-axhH4I8TGsm9JnzFiXSXmudnXS4=",
  "dev": true
},
 "systemjs": {
  "version": "https://registry.npmjs.org/systemjs/-/systemjs-0.19.46.tgz",
  "integrity": "sha1-wEV0szNfBSoOPHoA7kGIxuTB444=",
  "dev": true
},

2) example of package-lock.json dependencies with version and resolved properties:

"jspm": {
  "version": "0.16.53",
  "resolved": "https://registry.npmjs.org/jspm/-/jspm-0.16.53.tgz",
  "integrity": "sha1-VvNR9JWUyJM+XgG2UUWsrr/PtZ4=",
  "dev": true,
  "dependencies": {
    ...
  }
},
"systemjs": {
  "version": "0.19.46",
  "resolved": "https://registry.npmjs.org/systemjs/-/systemjs-0.19.46.tgz",
  "integrity": "sha1-wEV0szNfBSoOPHoA7kGIxuTB444=",
  "dev": true
},
...

In addition to having an unstable package-lock.json, our build server is having issues when installing the first example.

Upvotes: 3

Views: 2711

Answers (2)

Pierre Maoui
Pierre Maoui

Reputation: 6384

You may want to check in this situation on both machines that:

  • your node + npm version are the same and maybe doing npm -g update npm.
  • the npm configuration property save-exact has the same value on both machines. (otherwise doing npm config set save_exact true/false)

Upvotes: 1

Mobiletainment
Mobiletainment

Reputation: 23261

Follow this procedure to produce a stable version of the package-lock.json:

  1. delete the existing node_modules folder
  2. delete the existing package-lock.json
  3. perform npm install
  4. commit and push the package-lock.json

For the rest of the team:

  1. delete the existing node_modules folder
  2. pull the new package-lock.json
  3. perform npm install

Deleting the existing node_modules before continuing is an essential step because the package-lock.json does parse existing metadata from the node_modules folder. This means that if your node_modules folder has leftovers, they may get added to the package-lock's dependencies, even if they're not an actual dependency (anymore).

Upvotes: 6

Related Questions