16

I'm in the process of switching from npm to pnpm, which has a different set of features that I prefer.

The former uses package-lock.json to lock exact packages versions, the latter pnpm-lock.yaml.

According to the docs, pnpm ignores package-lock.json, which seems to become redundant. And, as a consequence, when updating packages with pnpm, this file will not be processed at all and will soon become outdated.

Can I safely delete package-lock.json or will I incur in some problems of sort? Could there be any drawbacks in deleting this file from my project?

I'm using npm only to get the tools and packages needed for my projects (i.e. Gulp), not to publish packages to https://www.npmjs.com/

Sekhemty
  • 1,222
  • 2
  • 13
  • 33

1 Answers1

25

If you use pnpm, you can remove package-lock.json (and yarn.lock if you are switching from Yarn). If you need to preserve some dependencies from your old lockfile, you can run pnpm import and pnpm will generate a lockfile using info from package-lock.json.

pnpm will create a lockfile of its own. pnpm's lockfile is called pnpm-lock.yaml. You should commit this file to the repository.

If you have a CI server, you'll have to use pnpm on the CI server as well, for installing dependencies. Here are some instructions how to do that.

Zoltan Kochan
  • 5,180
  • 29
  • 38