[BUG] How to settig, npm publish will include the lock file

[alanhe421]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I don't know the reason that package publish contains the package.lock file.

1. my node version is v16.
2. my package.json files property setting include package-lock.json
3. Of course, I know that it is right not to contain lock-file, but the current problem is that I find that sometimes it is carried and sometimes it is not. I want to know if it can be set to carry it, or it will not take effect regardless of whether the setting is set or not. is it a bug?

Expected Behavior

Doesn't carry a lock file anyway, or can control it yourself, not weirdly random.

Steps To Reproduce

I can't reproduce it effectively, it's more like random

Environment

• npm: v8
• Node.js: v16
• OS Name: Linux/Mac

[ljharb]

package-lock is a dev-only lockfile; it can never be published. If you see an npm version including it, it’s either a bug, or, it was published from an npm version < 5.

[alanhe421]

ok. Thanks for explaining. When using the latest version of cli, no matter how I set it will not include, as you said.

[alanhe421]

I test.

node is v8.17.0
npm is v6.13.4

lock include.

npm-cli v7 is ok.

I think <=v6 was published.