Create or refresh the npm lockfile
Medium risk
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Inspects the current package metadata, then resolves dependency versions into package-lock.json without installing packages into node_modules.
nodenpmlockfile
Commands
Confirm the command is running from the intended package root
npm pkg get nameResolve dependencies and write package-lock.json without running lifecycle scripts
npm install --package-lock-only --ignore-scriptsVerification
npm install --package-lock-only --ignore-scriptsnpm reports the dependency state is current and package-lock.json remains present.
Undo
Restore the previously tracked lockfile
git restore package-lock.jsonPitfalls
- The undo command only works when package-lock.json was already tracked; delete a newly created lockfile manually if it was not.
- Registry resolution can change lockfile entries even though node_modules is untouched.