Why does `npm install` generate different `package-lock.json` files for the same `package.json` file?

Question

Here is the relevant part of my package.json file:

  "devDependencies": {
    "ajv": "^6.0.0",
    "webpack": "^4.0.0",
    "websocket": "^1.0.0",
    "bignumber.js": "^7.0.0",
    "decimal.js": "^10.0.0",
    "truffle": "4.1.11",
    "ganache-cli": "6.1.0",
    "solidity-coverage": "0.5.4",
    "ethereumjs-testrpc-sc": "6.1.2",
    "web3": "1.0.0-beta.34"
  }

I have this file in two different repositories, on the same PC.

When I run npm install in each one of these repositories at the same time, I get a different package-lock.json file in each repository.

How could this be?

Here is a possible clue:

If I delete the package-lock.json file beforehand, then npm install aborts with an error.

So the answer to my question is possibly related to the fact that npm install relies on an already existing package-lock.json file.

And initially, I had different package-lock.json files in these repositories, because the corresponding package.json files were different.

Now that I've changed the package.json file in one of the repositories to be identical to the other, I am expecting that the corresponding package-lock.json files will also become identical.

Answer 1

From https://docs.npmjs.com/files/package-locks

"Conceptually, the "input" to npm-install is a package.json, while its "output" is a fully-formed node_modules tree: a representation of the dependencies you declared. In an ideal world, npm would work like a pure function: the same package.json should produce the exact same node_modules tree, any time. In some cases, this is indeed true. But in many others, npm is unable to do this. There are multiple reasons for this:

• different versions of npm (or other package managers) may have been used to install a package, each using slightly different installation algorithms."

The package-lock file is going to ensure that nothing breaks due to having slightly different package versions, running npm install on the same machine at the exact same time is not going to guarantee that the same version of all dependencies is acquired.

Another point that may clarify how a package file differs from a package-lock file. Two identical package.json files do not guarantee the same node_modules folder structure. But two identical package-lock files will guarantee the exact same node_modules file structure.