27

npm 5 introduced package-lock.json, of which the documentation is here.

It states that the file is intended to be included with version control, so anyone cloning your package and installing it will have the same dependency versions. In other words, you should not add it to your .gitignore file.

What it does not state is wether or not the file is intended to be included with a published package. This question could be rephrased as; should package-lock.json be included in .npmignore?

BuZZ-dEE
  • 3,875
  • 7
  • 48
  • 76
wybe
  • 447
  • 4
  • 13

1 Answers1

26

It cannot be published.

From the npm documentation:

One key detail about package-lock.json is that it cannot be published, and it will be ignored if found in any place other than the toplevel package

See package-lock.json documentation on docs.npmjs.com.

However, you should be commiting your package-lock.json to git as per the documentation.

This file is intended to be committed into source repositories

hence the common message presented by npm:

created a lockfile as package-lock.json. You should commit this file.

EDIT: A more detailed explanation can be found here.

Peter Reid
  • 4,169
  • 1
  • 33
  • 31
  • 16
    I'm still confused. This documentation seems to say contradictory things. On the one hand it says it 'cannot be published'. That would make sense if the next sentence would say that it is ignored on publish alltogether. But... instead, it says its will be ignored **if found in any place other than the toplevel package**. So that seems to say that if its found in the toplevel package... it **will** be published. Seems a bit contradictory. So... yeah. I'm confused. – Kris Feb 01 '18 at 17:54
  • 3
    @Kris I think the "ignored" passage means that all package-lock.jsons will be ignored, except for the top-level package which you are installing at that time. So, effectively, ignore during install as opposed to ignore during publish. Just a guess, though. – wybe Apr 10 '18 at 12:06