lock-verify

What is lock-verify?

The lock-verify npm package is used to verify the integrity of package-lock.json files. It ensures that the dependencies listed in the package-lock.json file are consistent with the actual installed node_modules directory. This helps in maintaining the integrity and consistency of the project dependencies.

What are lock-verify's main functionalities?

Verify package-lock.json

This feature verifies the integrity of the package-lock.json file against the node_modules directory. If the verification is successful, it logs a success message; otherwise, it logs the errors.

const lockVerify = require('lock-verify');

lockVerify().then(result => {
  if (result.status === 'success') {
    console.log('package-lock.json is valid');
  } else {
    console.error('package-lock.json is invalid');
    console.error(result.errors);
  }
}).catch(err => {
  console.error('An error occurred:', err);
});

Other packages similar to lock-verify

npm-audit

npm-audit is a built-in npm command that performs a security audit of the project's dependencies. While it focuses on security vulnerabilities rather than integrity verification, it provides a comprehensive report on potential security issues in the dependencies.

yarn

Yarn is an alternative package manager to npm that also provides a lock file (yarn.lock) to ensure consistent dependency installations. Yarn has a built-in command `yarn check` that verifies the integrity of the installed packages against the yarn.lock file, similar to what lock-verify does for npm.

npm-check

npm-check is a tool that checks for outdated, incorrect, and unused dependencies in a project. While it does not specifically verify the package-lock.json file, it helps in maintaining the overall health of the project's dependencies.

README

lock-verify

Report if your package.json is out of sync with your package-lock.json.

USAGE

Call it with no arguments to verify the current project's lock file. Errors are printed out to stdout and the status code set to 1.

$ npx lock-verify
Invalid: lock file's example@2.1.0 does not satisfy example@^1.1.0
Errors found
$

Call it with a path to a project to verify that project's lock file. If there are no errors, it prints nothing and the status code is 0.

$ npx lock-verify /path/to/my/project
$