Convert yarn.lock to package-lock.json and vice versa
Convert
yarn.lockto
package-lock.jsonand vice versa.
npm install -g synp
yarn # be sure the node_modules folder dir and is updated synp --source-file /path/to/yarn.lock # will create /path/to/package-lock.json
npm install # be sure the node_modules dir exists and is updated synp --source-file /path/to/package-lock.json # will create /path/to/yarn.lock
Note: if all you need is to convert in this direction (
package-lock.json=>
yarn.lock), as of 1.7.0, Yarn is able to import its dependency tree from npm’s package-lock.json natively, without external tools. Use the
yarn importcommand.
const { npmToYarn, yarnToNpm } = require('synp')const libPath = '/path/to/my/lib' const stringifiedYarnLock = npmToYarn(libPath) const stringifiedPackageLock = yarnToNpm(libPath)
Since
package-lock.jsonand
yarn.lockuse different methods in order to deterministically lock down dependency versions, oftentimes they do not contain all the information needed to be purely converted.
For this reason,
synpuses the existing
node_modulesdirectory of the package to determine the package state and assist in the conversion.
For this reason, it is vital to make sure the
node_modulesdirectory of the package is current and was installed by the respective tool (eg. by
yarnif converting to
package-lock.jsonand by
npmif converting to
yarn.lock).
Bundled dependencies: For various reasons, this tool does not 'play well' with bundled dependencies. This should not be a problem because installing the packages later with the converted file will (by definition) update the proper packages in the file. If this is not the case for you, please open an issue/PR with your use case and I'd be happy to take a look.
Package checksums: Both
yarn.lockand
package-lock.jsoninclude package checksums for dependencies. Since
npmis slowly moving to
sha-512checksums which
yarndoes not (yet) support, converting to
package-lock.jsonwill result in weaker checksums (that will still work!) and converting to
yarn.lockcan sometimes result in a corrupted result file. Thankfully, this issue is 100% solvable. In
npmone can update the checksums simply by deleting the
integrityfield of all or relevant packages. In
yarnthis can be solved with the
--update-checksums* flag when installing from the created file.
Format limitations: Some things that can be expressed in one format simply cannot be expressed in the other. These are (to the best of my knowledge) extreme edge cases and should not worry 99% of this tool's intended users. One example is
package-lock.json's ability to translate the same semver string to different versions. (eg. one package requesting version
^1.0.1of a dependency and receiving
1.0.5and a different package requesting version
^1.0.1of the same dependency and receiving
1.0.71. When translating to
yarn.lockthrough
synpboth will receive the same version).
Optional packages: ~~Like
npm(https://github.com/npm/npm/issues/17722),~~
synp~~also~~ has issues with optional dependencies across different platforms. This is because it uses
node_modulesas its state, and does not guess about packages that are not installed on the converting platform. Sadly, ~~like
npm~~ the only way to avoid this issue is to perform the conversion on the platform that meets most optional dependencies and update the rest manually. If this is a major issue for you, adding some sort of automatic tooling for this can be discussed.
* At the time of this writing, the
--update-checksumsflag in
yarnhas been merged but not released yet. Please see: https://github.com/yarnpkg/yarn/pull/4860
yarnuse
--update-checksums, in
npmdelete the
integrityfield from the offending package (have no fear! This will be updated upon installation).
node_modulesfrom the package to be converted, install it again (with
yarnif converting to
package-lock.jsonor
npmif converting to
yarn.lock) and run
synpone more time.
MIT