ENOENT: no such file or directory, open './package-lock.json'

[josguil]

If I try to force resolutions before package-json is present, I get the error:

ENOENT: no such file or directory, open './package-lock.json'

The only workaround is to delete the preinstall instruction, do npm install, then readd the npm force resolutions and then npm install again, but this workaround isn't ideal for automated build systems. Is there any solution?

[ronaldbarendse]

You should only add npm-force-resolutions after doing the initial install that generates the package-lock.json file. And make sure to include this file together with your package.json to your version control system.

If npm install returns errors after that, your node_modules probably isn't in-sync with the package-lock.json, so you first have to run npm ci (to install the exact versions from the package-lock.json file) 👍

[janrembold]

IMO npm-force-resolutions should silently exit if there is no package-lock.json and not force the user to manually remove the preinstall script before doing a first installation.

In my case, I just wanted to simply create a fresh lockfile and removed the existing one. Than I had to remove preinstall script, run npm i and add the preinstall script again.

I don't see any downsides on a silent exit

[ronaldbarendse]

@janrembold I agree it could show a warning instead of throwing an error if the package-lock.json file doesn't exist, as that would indeed make this case a little easier. However, to ensure the correct dependencies are updated/resolved, you'd need to run npm install a second time (as the first only generated the lock file). Either the warning message should be very clear about this and/or this behavior should only be allowed when explicitly enabled (e.g. using a command argument).

FYI If you just want to create a fresh lock file, you can run the following commands:

rm package-lock.json
npm shrinkwrap
ren npm-shrinkwrap.json package-lock.json

[janrembold]

@ronaldbarendse Fair point 🤔

Would it be possible to run npm shrinkwrap && ren npm-shrinkwrap.json package-lock.json within your package in case of a missing package-lock.json? This would fix the missing file problem and for all other cases it would run as usual.

[lazar-vuckovic]

An issue popped up in production today that I had to resolve quickly and had to override a nested package. Ran into a problem using npm-force-resolutions in a CI build, since the preinstall script requires the package to already be installed.
Ended up with a dirty temporary workaround - instead of putting the npx command in preinstall, I used the following:
"postshrinkwrap": "npx npm-force-resolutions && npm install --ignore-scripts"
Note the use of postshrinkwrap instead of a postinstall. If you do this in a postinstall, you don't have the package-lock.json file yet.

[ronaldbarendse]

@lazar-vuckovic You're having a totally different issue, as this command shouldn't even be executed on a CI build.

The package-lock.json should already be patched with the correct packages and versions on your local machine (using npm install and the postinstall hook), so the CI build can use npm ci to make a reproducible build...

[elizabethsjudd]

I'm running in to the same error with our package that uses preinstall: npx npx-force-resolutions but only when installing it in an external package because the package-lock.json file is not published. Is it expected that they also use npm-shrinkwrap to also publish that file or how would we resolve this issue?

[ronaldbarendse]

After digging deeper, it looks like I've encountered the same problem @lazar-vuckovic had: npm ci also runs the preinstall script (containing npx npm-force-resolutions), altering the package-lock.json file when it's not needed.

I've updated the postshrinkwrap script to make it more quiet and still run scripts of installed dependencies (--no-package-lock ensures the postschrinkwrap script won't get called in a loop):

"scripts": {
    "postshrinkwrap": "npx --quiet npm-force-resolutions && npm install --no-package-lock --no-audit --no-fund --no-progress --silent"
}

[kshetline]

I worked around this issue by doing this:

		"preinstall": "bash ./force-resolutions.sh",

With this matching script:

if [ -f package-lock.json ]; then
  npx npm-force-resolutions
fi

...but while this solves the immediate problem, it means my project can't be build on Windows, as was previously possible.

If you have some objection to what everyone else is suggesting, that npm-force-resolutions fail quietly when package-lock.json is not present, but only as a general rule, could you add a command line option to allow quiet failure?

[kshetline]

Seems janky but this seemed to work for the preinstall script:

"preinstall": "npm install --package-lock-only --ignore-scripts && npx npm-force-resolutions",

It feels wrong to run npm install inside preinstall but the --package-lock-only flag seems to do just so hoping it's ok.

I'll definitely try this, @nhartner. If this does the trick, it'll be a fantastic work-around.

[nhartner]

Seems janky but this seemed to work for the preinstall script:
"preinstall": "npm install --package-lock-only --ignore-scripts && npx npm-force-resolutions",
It feels wrong to run npm install inside preinstall but the --package-lock-only flag seems to do just so hoping it's ok.

I'll definitely try this, @nhartner. If this does the trick, it'll be a fantastic work-around.

Eh, spoke too soon. It worked locally but not once I published it to npmjs.

[kshetline]

@nhartner, your trick did work in my project, but I'm not publishing an npm package, so maybe that has something to do with it.

My project is a VSCode extension. I started from a clean slate (throwing away my whole node_modules folder and package-lock.json), did an npm i, then another npm i, an npm update, and another npm i, and it all worked great, with a clean audit after each step.

Update: Works great for me in another project too. It's interesting that I can see the warning found 1 low severity vulnerability go by once, then correct itself by time the npm i has finished.

[nhartner]

@nhartner, your trick did work in my project, but I'm not publishing an npm package, so maybe that has something to do with it.

My project is a VSCode extension. I started from a clean slate (throwing away my whole node_modules folder and package-lock.json), did an npm i, then another npm i, an npm update, and another npm i, and it all worked great, with a clean audit after each step.

Update: Works great for me in another project too. It's interesting that I can see the warning found 1 low severity vulnerability go by once, then correct itself by time the npm i has finished.

You could also add --no-audit flag in the preinstall to squelch the initial vulnerability warning.

[joyarzun]

Seems janky but this seemed to work for the preinstall script:
"preinstall": "npm install --package-lock-only --ignore-scripts && npx npm-force-resolutions",
It feels wrong to run npm install inside preinstall but the --package-lock-only flag seems to do just so hoping it's ok.

I'll definitely try this, @nhartner. If this does the trick, it'll be a fantastic work-around.

Not ideal but works :)

[edgar-arroyo-by]

hello there

try
"preinstall": "npx npm-force-resolutions || echo 1",

[mfranzke]

@edgar-arroyo-by I like your solution a lot, especially as this problem even also appears when installing the package you're using this dependency with as a dependency of another project. I've previously built a more complicated solution that would break in other constellations like e.g. PowerShell, but your solution is clean and simple. Awesome !

[angelogiuseppe]

To anyone experiencing this issue, feel free to try: https://www.npmjs.com/package/force-resolutions

Just change:

"preinstall": "npx npm-force-resolutions"

To:

"preinstall": "npx force-resolutions"

npx force-resolutions does not run when no package-lock.json is detected, and allows the next command inline to be executed as normal. This is useful when installing dependencies for a package that has been already published where package-lock.json is not available.

Feedback and PR's are welcome

[naveen2131-hue]

@edgar-arroyo-by "preinstall": "npm install --package-lock-only --ignore-scripts && npx npm-force-resolutions", scripts
not changing the sub dependencies version from package-lock.json. Any idea, how to solve it as well.

[cbtpro]

@janrembold I agree it could show a warning instead of throwing an error if the package-lock.json file doesn't exist, as that would indeed make this case a little easier. However, to ensure the correct dependencies are updated/resolved, you'd need to run npm install a second time (as the first only generated the lock file). Either the warning message should be very clear about this and/or this behavior should only be allowed when explicitly enabled (e.g. using a command argument).

FYI If you just want to create a fresh lock file, you can run the following commands:

rm package-lock.json
npm shrinkwrap
ren npm-shrinkwrap.json package-lock.json

It worked in my case

[Lumi669]

i am using pnpm instead of npm, so i don't have package-lock.json , i have pnpm-lock.yaml, how to solve this error in such situation?