1--- 2section: configuring-npm 3title: package-lock.json 4description: A manifestation of the manifest 5--- 6 7# package-lock.json(5) 8 9## A manifestation of the manifest 10 11### Description 12 13`package-lock.json` is automatically generated for any operations where npm 14modifies either the `node_modules` tree, or `package.json`. It describes the 15exact tree that was generated, such that subsequent installs are able to 16generate identical trees, regardless of intermediate dependency updates. 17 18This file is intended to be committed into source repositories, and serves 19various purposes: 20 21* Describe a single representation of a dependency tree such that teammates, deployments, and continuous integration are guaranteed to install exactly the same dependencies. 22 23* Provide a facility for users to "time-travel" to previous states of `node_modules` without having to commit the directory itself. 24 25* To facilitate greater visibility of tree changes through readable source control diffs. 26 27* And optimize the installation process by allowing npm to skip repeated metadata resolutions for previously-installed packages. 28 29One key detail about `package-lock.json` is that it cannot be published, and it 30will be ignored if found in any place other than the toplevel package. It shares 31a format with [npm-shrinkwrap.json](/configuring-npm/shrinkwrap-json), which is essentially the same file, but 32allows publication. This is not recommended unless deploying a CLI tool or 33otherwise using the publication process for producing production packages. 34 35If both `package-lock.json` and `npm-shrinkwrap.json` are present in the root of 36a package, `package-lock.json` will be completely ignored. 37 38 39### File Format 40 41#### name 42 43The name of the package this is a package-lock for. This must match what's in 44`package.json`. 45 46#### version 47 48The version of the package this is a package-lock for. This must match what's in 49`package.json`. 50 51#### lockfileVersion 52 53An integer version, starting at `1` with the version number of this document 54whose semantics were used when generating this `package-lock.json`. 55 56#### packageIntegrity 57 58This is a [subresource 59integrity](https://w3c.github.io/webappsec/specs/subresourceintegrity/) value 60created from the `package.json`. No preprocessing of the `package.json` should 61be done. Subresource integrity strings can be produced by modules like 62[`ssri`](https://www.npmjs.com/package/ssri). 63 64#### preserveSymlinks 65 66Indicates that the install was done with the environment variable 67`NODE_PRESERVE_SYMLINKS` enabled. The installer should insist that the value of 68this property match that environment variable. 69 70#### dependencies 71 72A mapping of package name to dependency object. Dependency objects have the 73following properties: 74 75##### version 76 77This is a specifier that uniquely identifies this package and should be 78usable in fetching a new copy of it. 79 80* bundled dependencies: Regardless of source, this is a version number that is purely for informational purposes. 81* registry sources: This is a version number. (eg, `1.2.3`) 82* git sources: This is a git specifier with resolved committish. (eg, `git+https://example.com/foo/bar#115311855adb0789a0466714ed48a1499ffea97e`) 83* http tarball sources: This is the URL of the tarball. (eg, `https://example.com/example-1.3.0.tgz`) 84* local tarball sources: This is the file URL of the tarball. (eg `file:///opt/storage/example-1.3.0.tgz`) 85* local link sources: This is the file URL of the link. (eg `file:libs/our-module`) 86 87##### integrity 88 89This is a [Standard Subresource 90Integrity](https://w3c.github.io/webappsec/specs/subresourceintegrity/) for this 91resource. 92 93* For bundled dependencies this is not included, regardless of source. 94* For registry sources, this is the `integrity` that the registry provided, or if one wasn't provided the SHA1 in `shasum`. 95* For git sources this is the specific commit hash we cloned from. 96* For remote tarball sources this is an integrity based on a SHA512 of 97 the file. 98* For local tarball sources: This is an integrity field based on the SHA512 of the file. 99 100##### resolved 101 102* For bundled dependencies this is not included, regardless of source. 103* For registry sources this is path of the tarball relative to the registry 104 URL. If the tarball URL isn't on the same server as the registry URL then 105 this is a complete URL. 106 107##### bundled 108 109If true, this is the bundled dependency and will be installed by the parent 110module. When installing, this module will be extracted from the parent 111module during the extract phase, not installed as a separate dependency. 112 113##### dev 114 115If true then this dependency is either a development dependency ONLY of the 116top level module or a transitive dependency of one. This is false for 117dependencies that are both a development dependency of the top level and a 118transitive dependency of a non-development dependency of the top level. 119 120##### optional 121 122If true then this dependency is either an optional dependency ONLY of the 123top level module or a transitive dependency of one. This is false for 124dependencies that are both an optional dependency of the top level and a 125transitive dependency of a non-optional dependency of the top level. 126 127All optional dependencies should be included even if they're uninstallable 128on the current platform. 129 130 131##### requires 132 133This is a mapping of module name to version. This is a list of everything 134this module requires, regardless of where it will be installed. The version 135should match via normal matching rules a dependency either in our 136`dependencies` or in a level higher than us. 137 138 139##### dependencies 140 141The dependencies of this dependency, exactly as at the top level. 142 143### See also 144 145* [npm shrinkwrap](/cli-commands/npm-shrinkwrap) 146* [shrinkwrap.json](/configuring-npm/shrinkwrap-json) 147* [package-locks](/configuring-npm/package-locks) 148* [package.json](/configuring-npm/package-json) 149* [npm install](/cli-commands/npm-install) 150