126

Question

What is the way to update/generate package-lock.json without making a real installation of node_modules (what npm install does)?

I want just a valid package-lock.json based on my package.json, that's it.

Motivation

You might use yarn locally, when CI server uses npm. It's probably not the best practice, but still might ok as a temporary solution.

Bonus question: Same for yarn. Is it possible to generate yarn-lock.json without doing a real installation?

S Panfilov
  • 16,641
  • 17
  • 74
  • 96

2 Answers2

216

npm

As of npm 6.x, you can use the following command:

npm i --package-lock-only

Documentation (https://docs.npmjs.com/cli/install.html) says:

The --package-lock-only argument will only update the package-lock.json, instead of checking node_modules and downloading dependencies.

yarn

As of yarn 3.0.0, you can use the following command:

yarn install --mode update-lockfile

Documentation (https://yarnpkg.com/cli/install#options-mode%20%230) says:

If the --mode=<mode> option is set, Yarn will change which artifacts are generated.

update-lockfile will skip the link step altogether, and only fetch packages that are missing from the lockfile (or that have no associated checksums). This mode is typically used by tools like Renovate or Dependabot to keep a lockfile up-to-date without incurring the full install cost.

As of Sep. 10, 2019: yarn doesn't seem to support generating a lock-file without installing the modules. Relevant GitHub issue: https://github.com/yarnpkg/yarn/issues/5738

Teh
  • 2,767
  • 2
  • 15
  • 16
  • 4
    The lock file must be deleted first. Is there any one command solution without the need to delete the lock file first? – mvorisek Apr 10 '21 at 11:56
  • I have to mention that sometimes package-lock.json might be slightly different from what you got in case you do a normal npm install – S Panfilov Sep 09 '21 at 12:34
  • Yeah, the trouble is it STILL doesn't seem to update transitives, like you might be expecting. It doesn't really update anything from the existing lockfile, although it will repair deleted things. – light24bulbs Nov 17 '22 at 19:29
6

I don't have enough reputation to comment, so just add an answer :)

In addition to Teh's answer, for Yarn now you can:

yarn install --mode update-lockfile

Documentation: https://yarnpkg.com/cli/install#options-mode%20%230

update-lockfile will skip the link step altogether, and only fetch packages that are missing from the lockfile (or that have no associated checksums). This mode is typically used by tools like Renovate or Dependabot to keep a lockfile up-to-date without incurring the full install cost.

Shao
  • 121
  • 1
  • 4