Correctly update npm's package-lock files in Lerna monorepos

[bajtos]

In loopback-next, we have a pretty standard Lerna monorepo setup:

• Several packages in subdirectories like packages/core and examples/hello-world
• We use the default strategy to resolve monorepo-local dependencies (lerna creates symlinks)
• We use npm to install dependencies
• Package locks are enabled at root level and in every individual package too
• Dependencies ARE NOT hoisted, they are always installed in the package that requires them.

An important aspect of this setup (as of lerna@3.13.2 and npm@6.9.0): package-lock files MUST EXCLUDE monorepo-local dependencies, otherwise npm ci replaces symlinks created by lerna with package content downloaded from the npm registry.

When greenkeeper detects a new dependency version in one of the subpackages, it creates two commits:

• One commit to update dependency version in package.json (see e.g. https://github.com/strongloop/loopback-next/commit/279881b9cc8bfe6aebdfd21248870ed47e8fc647)
• Another commit to update package-lock.json file (see e.g. https://github.com/strongloop/loopback-next/commit/f26e7e8607a7222397f0fb36bf1d1695ccff16f0)

Actual behavior

The commit updating package-lock.json file is incorrectly adding monorepo-local dependencies to the lock file.

Expected behavior

The commit updating package-lock.json file keeps monorepo-local dependencies out of the lock file.

Proposed solution

I assume GreenKeeper is running npm install in the package to update the lock file. This does not work in lerna monorepos.

To correctly update package locks, we are running the following two commands in monorepo's root:

lerna clean && lerna bootstrap --no-ci

I think the first command lerna clean should not be necessary in principle, unfortunately it's needed in practice - at least in my experience. (Possibly related: https://github.com/lerna/lerna/issues/2015).

It makes me wonder - can Greenkeeper use the same approach?

My main concern is that I am not sure what will happen when we run lerna bootstrap --no-ci and there are more out-of-date dependencies. Will the new package lock contain updates only for the dependency that was updated in package.json or will it update all dependencies to the latest in-range versions available?

[matheo]

We're having this problem with the lock file... Having in the package.json postinstall: "lerna bootstrap --no-ci" doesn't work, and the hoisted dependencies aren't included in the package-lock file. We have to npm run postinstall manually to get it updated, after npm i.