package-lock.json and deterministic installs in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of package-lock.json?

Why does Node.js create a package-lock.json file when you install packages?

A To store user credentials for npm registry access

B To lock the exact versions of installed packages for consistent installs across environments

C To list all outdated packages that need updating

D To define scripts for running tests and builds

💡 Hint

Think about how to make sure everyone gets the same package versions.

The package-lock.json file records the exact versions of all installed packages and their dependencies. This ensures that when someone else installs the project, they get the same versions, making installs deterministic and avoiding unexpected bugs.

❓ component_behavior

intermediate

What happens if package-lock.json is deleted before npm install?

If you delete package-lock.json and then run npm install, what is the most likely outcome?

A npm installs only devDependencies and skips regular dependencies

B npm refuses to install any packages without package-lock.json

C npm installs packages exactly as before without any changes

D npm installs the latest compatible versions based on package.json, possibly different from before

💡 Hint

Without the lock file, npm has no record of exact versions.

Without package-lock.json, npm uses the version ranges in package.json to fetch the latest compatible versions. This can lead to different versions being installed, which may cause inconsistencies.

📝 Syntax

advanced

Identify the error in this package-lock.json snippet

Look at this snippet from a package-lock.json file. What is wrong with it?

Node.js

{
  "name": "my-app",
  "version": "1.0.0",
  "lockfileVersion": 2,
  "dependencies": {
    "express": {
      "version": "4.17.1",
      "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
      "integrity": "sha512-...",
      "requires": {
        "accepts": "~1.3.7"
      }
    }
  },
  "devDependencies": {}
}

A Missing comma after the dependencies object before devDependencies

B The version field should be a number, not a string

C lockfileVersion must be 1, not 2

D The integrity field should be a boolean, not a string

💡 Hint

Check JSON syntax carefully between objects.

In JSON, objects must have commas between properties. Here, there is no comma after the dependencies object before devDependencies, causing a syntax error.

❓ state_output

advanced

What version of lodash will be installed?

Given this package.json and package-lock.json snippet, what version of lodash will npm install?

Node.js

{
  "dependencies": {
    "lodash": "^4.17.15"
  }
}

// package-lock.json snippet:
{
  "name": "my-app",
  "lockfileVersion": 2,
  "dependencies": {
    "lodash": {
      "version": "4.17.21",
      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
      "integrity": "sha512-..."
    }
  }
}

A 4.17.21 (the version locked in package-lock.json)

B 4.17.15 (the minimum version specified in package.json)

C The latest lodash version available on npm

D Installation will fail due to version conflict

💡 Hint

npm prefers the lock file version for installs.

npm uses package-lock.json to install exact versions. Even if package.json allows a range, the lock file fixes the version to 4.17.21 for deterministic installs.

🔧 Debug

expert

Why does npm install produce different results on two machines?

Two developers run npm install on the same project with the same package.json but different package-lock.json files. What is the most likely cause of different installed package versions?

A npm caches are always cleared on install, so versions differ randomly

B package.json overrides package-lock.json during install

C The package-lock.json files differ, causing npm to install different exact versions

D npm install ignores package-lock.json if node_modules exists

💡 Hint

Check if the lock files are identical on both machines.

npm installs exact versions from package-lock.json. If the lock files differ, even slightly, npm will install different versions, causing inconsistent environments.