Generate Package-lock.json for every package

Expected Behavior

Expected behaviour is to have a package-lock.json file generated for every package in packages folder.

Current Behavior

My current project structure look like:-

packages/internal-package-1/package.json packages/internal-package-2/package.json packages/internal-package-3/package.json lerna.json package.json package-lock.json

I am using lerna version 3.17.0.

Right now as shown above there is only one package-lock.json file which is generated for . the entire project and it only contains the dependency which in top package.json file.

My expectation was that for every package.json file corresponding package-lock.json should be generated but that is not the case. Furthermore, the top package-lock.json file only contains the dependencies in the top package.json and not the all the dependencies which are declared in evey package.json file.

Now, if we try to consume for example internal-package-1 in a different project that as there is no lock file for this package , latest version of the dependencies gets downloaded which is not the expected behaviour.

Possible Solution

Possible solution or expectation is to have a lock file generated for every package.

lerna.json

{
  "packages": [
    "packages/*",
    "packages/Foundation/src/SampleNestedModule"    
  ],
  "version": "0.0.0"
}

Context

This issue is affecting us because as the lock file is not generated for every package and if i try to consume the internal-package-1 in a different project then locked dependency are not getting downloaded but the latest version of them gets downloaded.

Your Environment

We are hoisting the dependency hence we have modified out npm install script as below:- “install”: “lerna bootstrap --hoist” , this correctly hoists the dependency but does not generate the lock file for individual package.

Executable	Version
lerna --version	3.17.0
npm --version	6.10.1
yarn --version	Not using yarn
node --version	10.16.0

| OS | Version | MACOS | NAME | VERSION | | macOS Catalina | 10.15.2 | –>

[Vishesh30]

I couldn’t find a concrete solution to generate lock files for all packages. I mean there are ways but, everything is increasing the installing time to very high. Below are 2 ways to generate package-lock.json file for all packages:-

1. Directly use lerna bootstrap without --hoist flag ------- This does generate lock file but increases the install time way to high.
2. Use “lerna exec – npm i” ------ This will generate the lock file but “install” times are way higher not a viable solution with 25 packages in my repository.

As above 2 solutions were taking way to much time hence i considered them as not a feasible solution for large repos hence, i came up with a third way or i would call it a workaround , this is also not the cleaneast solution but does the job with very slight increase in installation time.

1. Create a npm script in all your packages which would generate only package-lock file without installation which would be something like below:- "genPackagelock": "npm i --package-lock-only"

2. In you root package.json file as part of postinstall call the above defined script for all the packages as below:- "postinstall": "lerna run --parallel genPackagelock"

The above “postinstall” basically generates package-lock.json file for all the packages along with the internal dependencies.

I am not closing the Bug because the above solutions are a workaround and not one of the best solution.

@jannikbuschke @revelt – What do you think of above solution any thought or shortcomings you see.?

[AndrewSouthpaw]

Can confirm we have this problem too. One of the workarounds appears to be passing the --force-local flag, which gets around this execution branch that disables the lockfile generation:

https://github.com/lerna/lerna/blob/a47fc294393a3e9507a8207a5a2f07648a524722/commands/bootstrap/index.js#L149

(Hat tip to @liamuk for discovering.)