What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To keep npm installs tied to reviewed dependency versions, commit package-lock.json, leave npm’s package-lock setting enabled, and use npm ci for clean CI or deployment installs. Keep npm versions and any options that shape the dependency tree consistent across environments, and review lockfile changes whenever you intentionally update packages.
Keep the lockfile in the project
package-lock.json records the dependency tree npm generated, including resolved package information. Commit it alongside package.json so developers, deployment systems, and CI can install from the same recorded dependency state. See npm’s package-lock.json documentation.
As an Amazon Associate I earn from qualifying purchases.
For routine work, do not set package-lock=false. The documented default for package-lock is true. Turning it off makes npm ignore package lockfiles during installation and prevents npm from writing one when saving is enabled. Check project, user, and environment configuration if npm appears to be ignoring the committed lockfile.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choose the install command for the job
| Command or setting | Effect | Use it when |
|---|---|---|
npm install |
Uses the lockfile when its resolved versions satisfy the manifest’s version ranges. Adding or updating dependencies can change dependency state. | You intend to change dependencies or set up a project. |
npm ci |
Requires a lockfile, fails if the manifest and lockfile disagree, removes the existing node_modules, and does not write to package.json or package-lock.json. |
You need a clean install from the committed dependency state, especially in CI or deployment. |
package-lock=true |
Keeps lockfile use enabled; this is the documented default. | Normal project work where installs should honor the lockfile. |
package-lock=false |
Makes npm ignore package lockfiles and prevents writing one when save is enabled. | Generally not appropriate when the goal is to use a lockfile. |
strict-peer-deps=true |
Makes peer dependency conflicts fail when npm might otherwise resolve them with a warning. | You want peer incompatibilities reviewed rather than accepted with a warning. |
Use npm ci only when replacing the current installation is acceptable: it deletes the existing node_modules directory before installing. For details, see npm’s npm ci documentation and npm install documentation.
#1 Best Overall
Make installs consistent across machines
A lockfile can depend on options that shape how npm builds the dependency tree. npm specifically notes options such as legacy-peer-deps and install-links: if the lockfile was created with such options, use the same settings with npm ci. Otherwise, a clean install may not reproduce the tree represented by the lockfile.
When a project needs these options, record them in a committed project-level .npmrc so teammates and CI receive the same configuration. For example, if the project intentionally uses legacy peer dependency handling, a project .npmrc can contain:
legacy-peer-deps=trueOnly add settings the project actually requires. If peer conflicts should stop installation for review, set strict-peer-deps=true in the project configuration; npm will then fail on conflicts it might otherwise resolve with a warning.
Align npm versions in local development and CI where possible. npm documents different lockfile generations across releases, and older lockfiles can lack metadata a newer npm needs. Version consistency reduces avoidable lockfile churn, though it is not a guarantee that every npm-version pairing behaves identically.
Rank #3
Manage lockfile format changes deliberately
npm’s package-lock documentation associates lockfile version 1 with npm 5 and 6, version 2 with npm 7 and 8, and version 3 with npm 9 and later. npm attempts to use data from lockfiles it was not designed to support, but older formats may require missing metadata to be fetched and can be updated during installation. When changing npm generations, inspect the resulting lockfile diff rather than treating it as an incidental edit. See npm’s lockfile format notes.
Quick Recap
Rank #4
Use a reviewable dependency-update workflow
- For a clean install: run
npm cifrom the project root. It requires a lockfile, checks that it agrees withpackage.json, and replacesnode_modules. - For an intentional dependency change: use
npm installto add or update packages, then inspect changes to bothpackage.jsonandpackage-lock.jsonbefore committing. - For exact manifest versions on newly added dependencies: use
npm install --save-exact. This saves newly added dependencies as exact versions inpackage.json; it does not replace the role of the lockfile. - For a security remediation: treat
npm audit fixas a proposed dependency update, not a no-change check. It applies remediations using npm install behavior and can alter the dependency tree. Review its lockfile diff and run the project’s normal verification before merging. If you need to update the lockfile without modifyingnode_modules, usenpm audit fix --package-lock-only. See npm’s audit documentation.
Diagnose unexpected lockfile changes
- The lockfile is missing or ignored: check that
package-lockhas not been set tofalsein npm configuration, and commit the project lockfile. npm cireports a manifest/lock mismatch: the files no longer describe a compatible dependency state. Resolve the mismatch intentionally withnpm install, review both file changes, then commit the corrected pair.npm ciproduces a different tree or fails on dependency handling: check whether the lockfile was created using tree-shaping flags such aslegacy-peer-depsorinstall-links, and use consistent settings.- A routine install changes the lockfile after an npm upgrade: check the npm version and lockfile format. Older formats may be updated as npm obtains missing metadata; review and commit such a change only when intended.
- A peer conflict only warns: configure
strict-peer-deps=trueif the project policy is to stop and resolve peer conflicts rather than proceed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
