We have a react project. We are using the same node version (18.16.1) and the same npm version (9.5.1) as a whole team. When I run npm install after cloning the repo, I get a different package-lock file. Why is that happening?
To summarize, npm install is not guaranteed to be a deterministic, reproducible build. If you want exact reproducibility, you should use npm ci to install dependencies.
Your package-lock.json is automatically generated/updated when you install or update dependencies, and reflects the currently installed packages for that project. So the reason the package-lock.json is different across machines is due to the nondeterminism of npm install.
2
Answers
@a.deshpande012's answer was okay when I did install but IMHO, probably it was going to give another error if I install another package.
The fix was aligning .npmrc file with others.
Take a look at this question.
To summarize,
npm install
is not guaranteed to be a deterministic, reproducible build. If you want exact reproducibility, you should usenpm ci
to install dependencies.Your
package-lock.json
is automatically generated/updated when you install or update dependencies, and reflects the currently installed packages for that project. So the reason thepackage-lock.json
is different across machines is due to the nondeterminism ofnpm install
.