lerna bootstrap modifies package-lock.json files

Our project have several packages: A B C depends on A & B D depends on A, B & C

all packages have package-lock.json file.

When running lerna --bootstrap

Expected Behavior

symbolic links should be created. package-lock.json should not be modified (only when running lerna publish, package-lock.json should be modified)

Current Behavior

symbolic links are created. package-lock.json files are modified, removing references of all local packages.

Workaround: running lerna exec --concurrency 1 git checkout -- package-lock.json right after lerna bootstrap to correct package-lock.json files

Environment info:

System: OS: Windows 10 10.0.17134 CPU: (8) x64 Intel® Core™ i7-8650U CPU @ 1.90GHz Binaries: Node: 12.15.0 - C:\Program Files\nodejs\node.EXE npm: 6.13.7 - C:\Program Files\nodejs\npm.CMD Utilities: Git: 2.25.0. npmPackages: lerna: 3.20.2 => 3.20.2

[raijinsetsu]

lerna bootstrap is just calling npm install under the hood after removing local packages from the package.json. So, expect your package-lock.json file to change per npm’s algorithm.

Use lerna bootstrap --ci to prevent the package-lock.json changes.

[zgriesinger]

We have encountered a similar “issue”.

It seems the lerna bootstrap command is functioning as intended. In our case we have this scenario:

• Using npm
• Using lerna bootstrap --hoist
• Managing private packages that are not pushed to remote
• 1 package-lock file at root (Because dependencies are hoisted)

When cloning the repo, we were having users run npm install. The issue with this, is that it will completely rewrite the root package-lock.json file to only have the dependencies specified at the root. This removes the entries written to the lock file with lerna bootstrap --hoist. Then, when a user runs lerna bootstrap --hoist they get every single dependency with a ^ in the version updated.

Once we started omitting the npm install step and requiring a pure clone to use npx lerna bootstrap --hoist to pull down dependencies, our package-lock.json file started to look like we would expect, with only new additions being new added dependencies.

However, this is a little bit unorthodox. Having a repository using npm but requiring users to not run npm install is weird for new users. We have added this to prevent someone from inadvertently running npm install:

 "preinstall": "echo 'Please use `npx lerna bootstrap` to install dependencies' && exit 1",

Using yarn as a package manager somewhat gets around this, because the bootstrap step and the initial install step uses the same (yarn) binary. We haven’t switched to yarn because it doesn’t provide an easy way to run a scoped bootstrap when dependencies are private and not published to any registry.

I’d be interested to know if there’s any way to maintain the ability to to a pure npm install without rewriting the root package-lock and thus causing lerna bootstrap --hoist to upgrade all ^ dependencies.