package-lock.json 包含非精确版本

Question

It describes the exact tree that was generated, such that subsequent installs are able to generate identical trees, regardless of intermediate dependency updates.

我正在查看一个 package-lock.json 文件，其中包含以下版本：

"less": "^3.0.4",
"less-loader": "^4.1.0",
"license-webpack-plugin": "^1.3.1",
"lodash": "^4.17.4",
"memory-fs": "^0.4.1

在依赖项之一的 requires 块中。

虽然主项目的子依赖项是 "locked down" 因为没有版本歧义，但这些传递依赖项不是。但是，如果树中的任何依赖项需要解释，npm "able to generate identical trees, regardless of intermediate dependency updates" 又如何呢？

Answer 1

根据 this thread，在 npm@6 中，package-lock.json 在内部表示依赖版本的方式发生了变化，因为它记录了最初请求的范围依赖，但仍然锁定了一个具体版本。

以前，包锁不记录依赖项最初请求的版本，只记录它在创建时将其解析为哪个版本。

示例如下：包裹-lock.json

// OLD npm format
// Notice that ajv.requires contains specific version for 'fast-json-stable-stringify'
// also notice that 'fast-json-stable-stringify' entry **mentions for the second time** specific version
{ 
    ...
    "dependencies": {
       ... 
        "ajv": {
                "version": "6.11.0",
                "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.11.0.tgz",
                "integrity": "sha512-nCprB/0syFYy9fVYU1ox1l2KN8S9I+tziH8D4zdZuLT3N6RMlGSGt5FSTpAiHB/Whv8Qs1cWHma1aMKZyaHRKA==",
                "dev": true,
                "requires": {
                    "fast-deep-equal": "3.1.1",
                    "fast-json-stable-stringify": "2.1.0",
                    "json-schema-traverse": "0.4.1",
                    "uri-js": "4.2.2"
                }
        },  
        ... 
        "fast-json-stable-stringify": {
            "version": "2.1.0",
            "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
            "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
            "dev": true
        },
        ... 
    }
    ...
}

这是 npm6 方法


// "new" npm format (as of npm@6)
// Notice that ajv.requires is not showing specific versions
// but instead shows same values as package.json contains
// However 'fast-json-stable-stringify' entry contains 
// SPECIFIC version to have reproducible build
 
{ 
    ...
    "dependencies": {
       ... 
        "ajv": {
                "version": "6.11.0",
                "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.11.0.tgz",
                "integrity": "sha512-nCprB/0syFYy9fVYU1ox1l2KN8S9I+tziH8D4zdZuLT3N6RMlGSGt5FSTpAiHB/Whv8Qs1cWHma1aMKZyaHRKA==",
                "dev": true,
                "requires": {
                    "fast-deep-equal": "^3.1.1",
                    "fast-json-stable-stringify": "^2.0.0",
                    "json-schema-traverse": "^0.4.1",
                    "uri-js": "^4.2.2"
                }
        },  
        ... 
        "fast-json-stable-stringify": {
            "version": "2.1.0",
            "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
            "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
            "dev": true
        },
        ... 
    }
    ...
}

package-lock.json 包含非精确版本

package-lock.json contains non-exact versions

npm

npm-install

package-lock.json