Fincer
/
simple-email


<!doctype html>

<html>

  <title>package-lock.json</title>

  <meta charset="utf-8">

  <link rel="stylesheet" type="text/css" href="../../static/style.css">

  <link rel="canonical" href="https://www.npmjs.org/doc/files/package-lock.json.html">

  <script async=true src="../../static/toc.js"></script>


  <body>

    <div id="wrapper">


<h1><a href="../files/package-lock.json.html">package-lock.json</a></h1> <p>A manifestation of the manifest</p>

<h2 id="description">DESCRIPTION</h2>

<p><code>package-lock.json</code> is automatically generated for any operations where npm

modifies either the <code>node_modules</code> tree, or <code>package.json</code>. It describes the

exact tree that was generated, such that subsequent installs are able to

generate identical trees, regardless of intermediate dependency updates.</p>

<p>This file is intended to be committed into source repositories, and serves

various purposes:</p>

<ul>

<li><p>Describe a single representation of a dependency tree such that teammates, deployments, and continuous integration are guaranteed to install exactly the same dependencies.</p>

</li>

<li><p>Provide a facility for users to &quot;time-travel&quot; to previous states of <code>node_modules</code> without having to commit the directory itself.</p>

</li>

<li><p>To facilitate greater visibility of tree changes through readable source control diffs.</p>

</li>

<li><p>And optimize the installation process by allowing npm to skip repeated metadata resolutions for previously-installed packages.</p>

</li>

</ul>

<p>One key detail about <code>package-lock.json</code> is that it cannot be published, and it

will be ignored if found in any place other than the toplevel package. It shares

a format with <a href="../files/npm-shrinkwrap.json.html">npm-shrinkwrap.json(5)</a>, which is essentially the same file, but

allows publication. This is not recommended unless deploying a CLI tool or

otherwise using the publication process for producing production packages.</p>

<p>If both <code>package-lock.json</code> and <code>npm-shrinkwrap.json</code> are present in the root of

a package, <code>package-lock.json</code> will be completely ignored.</p>

<h2 id="file-format">FILE FORMAT</h2>

<h3 id="name">name</h3>

<p>The name of the package this is a package-lock for. This must match what&#39;s in

<code>package.json</code>.</p>

<h3 id="version">version</h3>

<p>The version of the package this is a package-lock for. This must match what&#39;s in

<code>package.json</code>.</p>

<h3 id="lockfileversion">lockfileVersion</h3>

<p>An integer version, starting at <code>1</code> with the version number of this document

whose semantics were used when generating this <code>package-lock.json</code>.</p>

<h3 id="packageintegrity">packageIntegrity</h3>

<p>This is a <a href="https://w3c.github.io/webappsec/specs/subresourceintegrity/">subresource

integrity</a> value

created from the <code>package.json</code>. No preprocessing of the <code>package.json</code> should

be done. Subresource integrity strings can be produced by modules like

<a href="https://www.npmjs.com/package/ssri"><code>ssri</code></a>.</p>

<h3 id="preservesymlinks">preserveSymlinks</h3>

<p>Indicates that the install was done with the environment variable

<code>NODE_PRESERVE_SYMLINKS</code> enabled. The installer should insist that the value of

this property match that environment variable.</p>

<h3 id="dependencies">dependencies</h3>

<p>A mapping of package name to dependency object.  Dependency objects have the

following properties:</p>

<h4 id="version">version</h4>

<p>This is a specifier that uniquely identifies this package and should be

usable in fetching a new copy of it.</p>

<ul>

<li>bundled dependencies: Regardless of source, this is a version number that is purely for informational purposes.</li>

<li>registry sources: This is a version number. (eg, <code>1.2.3</code>)</li>

<li>git sources: This is a git specifier with resolved committish. (eg, <code>git+https://example.com/foo/bar#115311855adb0789a0466714ed48a1499ffea97e</code>)</li>

<li>http tarball sources: This is the URL of the tarball. (eg, <code>https://example.com/example-1.3.0.tgz</code>)</li>

<li>local tarball sources: This is the file URL of the tarball. (eg <code>file:///opt/storage/example-1.3.0.tgz</code>)</li>

<li>local link sources: This is the file URL of the link. (eg <code>file:libs/our-module</code>)</li>

</ul>

<h4 id="integrity">integrity</h4>

<p>This is a <a href="https://w3c.github.io/webappsec/specs/subresourceintegrity/">Standard Subresource

Integrity</a> for this

resource.</p>

<ul>

<li>For bundled dependencies this is not included, regardless of source.</li>

<li>For registry sources, this is the <code>integrity</code> that the registry provided, or if one wasn&#39;t provided the SHA1 in <code>shasum</code>.</li>

<li>For git sources this is the specific commit hash we cloned from.</li>

<li>For remote tarball sources this is an integrity based on a SHA512 of

the file.</li>

<li>For local tarball sources: This is an integrity field based on the SHA512 of the file.</li>

</ul>

<h4 id="resolved">resolved</h4>

<ul>

<li>For bundled dependencies this is not included, regardless of source.</li>

<li>For registry sources this is path of the tarball relative to the registry

URL.  If the tarball URL isn&#39;t on the same server as the registry URL then

this is a complete URL.</li>

</ul>

<h4 id="bundled">bundled</h4>

<p>If true, this is the bundled dependency and will be installed by the parent

module.  When installing, this module will be extracted from the parent

module during the extract phase, not installed as a separate dependency.</p>

<h4 id="dev">dev</h4>

<p>If true then this dependency is either a development dependency ONLY of the

top level module or a transitive dependency of one.  This is false for

dependencies that are both a development dependency of the top level and a

transitive dependency of a non-development dependency of the top level.</p>

<h4 id="optional">optional</h4>

<p>If true then this dependency is either an optional dependency ONLY of the

top level module or a transitive dependency of one.  This is false for

dependencies that are both an optional dependency of the top level and a

transitive dependency of a non-optional dependency of the top level.</p>

<p>All optional dependencies should be included even if they&#39;re uninstallable

on the current platform.</p>

<h4 id="requires">requires</h4>

<p>This is a mapping of module name to version.  This is a list of everything

this module requires, regardless of where it will be installed.  The version

should match via normal matching rules a dependency either in our

<code>dependencies</code> or in a level higher than us.</p>

<h4 id="dependencies">dependencies</h4>

<p>The dependencies of this dependency, exactly as at the top level.</p>

<h2 id="see-also">SEE ALSO</h2>

<ul>

<li><a href="../cli/npm-shrinkwrap.html">npm-shrinkwrap(1)</a></li>

<li><a href="../files/npm-shrinkwrap.json.html">npm-shrinkwrap.json(5)</a></li>

<li><a href="../files/npm-package-locks.html">npm-package-locks(5)</a></li>

<li><a href="../files/package.json.html">package.json(5)</a></li>

<li><a href="../cli/npm-install.html">npm-install(1)</a></li>

</ul>


</div>


<table border=0 cellspacing=0 cellpadding=0 id=npmlogo>

<tr><td style="width:180px;height:10px;background:rgb(237,127,127)" colspan=18>&nbsp;</td></tr>

<tr><td rowspan=4 style="width:10px;height:10px;background:rgb(237,127,127)">&nbsp;</td><td style="width:40px;height:10px;background:#fff" colspan=4>&nbsp;</td><td style="width:10px;height:10px;background:rgb(237,127,127)" rowspan=4>&nbsp;</td><td style="width:40px;height:10px;background:#fff" colspan=4>&nbsp;</td><td rowspan=4 style="width:10px;height:10px;background:rgb(237,127,127)">&nbsp;</td><td colspan=6 style="width:60px;height:10px;background:#fff">&nbsp;</td><td style="width:10px;height:10px;background:rgb(237,127,127)" rowspan=4>&nbsp;</td></tr>

<tr><td colspan=2 style="width:20px;height:30px;background:#fff" rowspan=3>&nbsp;</td><td style="width:10px;height:10px;background:rgb(237,127,127)" rowspan=3>&nbsp;</td><td style="width:10px;height:10px;background:#fff" rowspan=3>&nbsp;</td><td style="width:20px;height:10px;background:#fff" rowspan=4 colspan=2>&nbsp;</td><td style="width:10px;height:20px;background:rgb(237,127,127)" rowspan=2>&nbsp;</td><td style="width:10px;height:10px;background:#fff" rowspan=3>&nbsp;</td><td style="width:20px;height:10px;background:#fff" rowspan=3 colspan=2>&nbsp;</td><td style="width:10px;height:10px;background:rgb(237,127,127)" rowspan=3>&nbsp;</td><td style="width:10px;height:10px;background:#fff" rowspan=3>&nbsp;</td><td style="width:10px;height:10px;background:rgb(237,127,127)" rowspan=3>&nbsp;</td></tr>

<tr><td style="width:10px;height:10px;background:#fff" rowspan=2>&nbsp;</td></tr>

<tr><td style="width:10px;height:10px;background:#fff">&nbsp;</td></tr>

<tr><td style="width:60px;height:10px;background:rgb(237,127,127)" colspan=6>&nbsp;</td><td colspan=10 style="width:10px;height:10px;background:rgb(237,127,127)">&nbsp;</td></tr>

<tr><td colspan=5 style="width:50px;height:10px;background:#fff">&nbsp;</td><td style="width:40px;height:10px;background:rgb(237,127,127)" colspan=4>&nbsp;</td><td style="width:90px;height:10px;background:#fff" colspan=9>&nbsp;</td></tr>

</table>

<p id="footer">package-lock.json &mdash; npm@6.4.1</p>