package-lock.json not updated after removing a package from package.json?

Question

If i manually add a package to package.json and then run npm install, my package-lock.json gets updated with that new package's dependencies.

However, if i then manually delete that package from package.json from npm install, that package's dependencies are not removed from package-lock.json.

So - package-lock.json only gets modified when adding/updating packages in package.json? Not when removing?

Try [`npm prune`](https://docs.npmjs.com/cli-commands/prune.html) — Phil, Sep 24 '20 at 05:04
@Phil that doesn't work unfortunately. I know a solution is to just remove `package-lock.json` and run `npm install`, but i'm not really looking for a solution - i'm looking for an understanding: why `package-lock.json` doesn't get updated? — Gambit2007, Sep 24 '20 at 05:12

score 8 · Answer 1 · answered Sep 24 '20 at 06:41

This is a known issue with npm.

See issue :package-lock.json file not updated after package.json file is changed

" For now I'm working around it by changing my npm install command to rm -f package-lock.json && npm install. Obviously, that's not an elegant solution, and somewhat defeats the purpose of having a lockfile in the first place."

rm -f package-lock.json && npm install

This is supposed to be fixed in : https://github.com/npm/npm/pull/17508

See article : https://medium.com/coinmonks/everything-you-wanted-to-know-about-package-lock-json-b81911aa8ab8 for a better understanding.

All of this info is from 3 years ago.. so wasn't this supposed to be fixed? — Gambit2007, Sep 24 '20 at 07:46

score 1 · Answer 2 · answered Sep 16 '22 at 16:28

Removal of package-lock.json should be only done in case of corrupted lock file. To remove package you should just use npm cli (it will update lock file)

npm uninstall <package>

This is a good explanation. https://stackoverflow.com/a/54127283/5040275

score -1 · Answer 3 · answered Sep 24 '20 at 05:12

From the NodeJs docs

The package-lock.json sets your currently installed version of each package in stone, and npm will use those exact versions when running npm install.

NPM by default will read the package-lock.json file.

Therefore, in the first scenario, npm is reading the package entry from package.json since that's the only file which has an entry of the particular package. Whereas in the second scenario, it is reading it from package-lock.json, as is its default behaviour

package-lock.json not updated after removing a package from package.json?

3 Answers3