Managing package.json & package-lock.json with Git

Question

I know you're supposed to add package-lock.json to your git repo to ensure team members are using the same versions of dependencies.

Running npm install will check for a package-lock.json and install the versions indicated there. If a lock file is not present it will install packages from their sources as indicated by package.json.

Should package.json be added to your git repo as well, then?

If not, a new team member who clones the repo would get the lock file but a package.json file cannot be generated from a lock file, correct?

Bonus question: How should one handle merge conflicts in package-lock.json? Since they are machine-generated, I find that this happens often and its not always clear how they should be resolved.

package.json is required - if you ever wish to add a package, it will require the use of package.json - not to mention it contains the central place for human-readable analysis of packages used AND project attributes (commands, project locations, etc etc) — Derek Pollard
– Derek Pollard, Commented Apr 15, 2019 at 18:31
Not to mention, you cannot have a project with only package.json - npm wouldn't know what to do upon install for new developers — Derek Pollard
– Derek Pollard, Commented Apr 15, 2019 at 18:33

Martin Poelstra · Accepted Answer · 2019-08-02 21:11:47Z

5

To answer your bonus question:

There's a way to teach Git to automatically 'merge' package-lock.json files, using a merge driver and a .gitattributes file.

TL;DR

Run this once on each developer machine:

git config --global merge.theirs.name "Keep changes of upstream branch"
git config --global merge.theirs.driver "cp -f '%B' '%A'"

Add the following .gitattributes file to your repo (and commit it):

package-lock.json merge=theirs

See my blog post for a more detailed explanation.

answered Aug 2, 2019 at 21:11

Martin Poelstra

3502 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Gonzalo Matheu · Accepted Answer · 2023-03-03 00:28:42Z

3

Yes, package.json should be included as well. Besides containing project metadata and being required by npm, it provides a clean and concise view of explicit dependencies.

Regarding conflicts, the best option might be to use one of them entirely (not trying to merge). Or just re-create it from scratch. You might be having many conflict in the early phases of a project where all main dependencies are being added.

edited Mar 3, 2023 at 0:28

answered Apr 15, 2019 at 18:36

Gonzalo Matheu

10.2k6 gold badges42 silver badges67 bronze badges

Collectives™ on Stack Overflow

Managing package.json & package-lock.json with Git

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related