{
  "title": "Dependency lockfile diff",
  "human_url": "https://happytails.ai/en/developer-tools/dependency-lockfile-diff/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/dependency-lockfile-diff/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/dependency-lockfile-diff.md",
  "content": "Dependency lockfile diff\nCompare two lockfiles and see which packages were added, removed, upgraded or downgraded, split into direct and transitive dependencies.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use Dependency lockfile diff\nPaste the earlier lockfile after a line ==> before/package-lock.json <==.\nPaste the later lockfile after a line ==> after/package-lock.json <==.\nRun the comparison.\nReview the change table and download the Markdown, JSON or CSV report.\nUseful next steps\nSemver Range Tester\nSPDX Expression Validator\nJSON diff\nWhat it does\nBoth lockfiles are parsed and every package name is compared by its set of locked versions. Single version changes are classed as upgrades or downgrades by Semantic Versioning 2.0.0 precedence; packages locked at several versions, versions that are not SemVer and versions that differ only in build metadata are reported as changed. Direct dependencies come from the root package entry, and transitive ones show the shortest chain of dependencies that brings them in. A package installed under an npm alias, such as lodash3 for npm:lodash@^3.10.0, is listed under its real name and counts as direct when the alias is.\nSupported formats\npackage-lock.json and npm-shrinkwrap.json versions 1 to 3, yarn.lock classic and Berry, and pnpm-lock.yaml versions 5 to 9, including git, tarball and local file dependencies. The two files may use different formats. package-lock.json version 1 and yarn.lock classic have no root package entry, so their direct and transitive split shows as unknown unless a package.json is placed in the same folder as the lockfile.\nLimits\nNothing is fetched from a registry, so the report only knows what the lockfiles contain. Introducing chains follow package names and do not model nested node_modules resolution; chains longer than 32 packages are flagged with their depth.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "Semver Range Tester",
      "url": "https://happytails.ai/en/developer-tools/semver-range-tester/"
    },
    {
      "name": "SPDX Expression Validator",
      "url": "https://happytails.ai/en/developer-tools/spdx-expression-validator/"
    },
    {
      "name": "JSON diff",
      "url": "https://happytails.ai/en/developer-tools/json-diff/"
    }
  ],
  "tool": {
    "id": "dependency-lockfile-diff",
    "category": "developer-tools",
    "built": true,
    "requirements": "Up to 300,000 characters in total and 20,000 packages per lockfile. The comparison runs in your browser. Downloads: Markdown summary, JSON report and CSV.",
    "implementation": {
      "fields": [],
      "registrationFamily": "project-snapshot-reference",
      "inputMaxLength": 300000,
      "inputErrorCode": "PROJECT_SNAPSHOT_REFERENCE_TOO_LONG",
      "note": "Both lockfiles are compared on this device; no package registry is contacted.",
      "experience": {
        "automatic": false,
        "single": false,
        "inputMaxLength": 300000,
        "inputMode": "text",
        "label": "Two lockfiles",
        "placeholder": "==> before/package-lock.json <==",
        "help": "Paste the earlier lockfile first and the later one second, each after a ==> path <== line. Up to 300,000 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# Dependency lockfile diff\n\n- Human page: https://happytails.ai/en/developer-tools/dependency-lockfile-diff/\n- Markdown: https://happytails.ai/en/developer-tools/dependency-lockfile-diff.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/dependency-lockfile-diff/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `dependency-lockfile-diff` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nBoth lockfiles are compared on this device; no package registry is contacted.\n\n### Inputs and settings\n\nText input: Two lockfiles.\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\n==> before/package-lock.json <==\n```\n\nPaste the earlier lockfile first and the later one second, each after a ==> path <== line. Up to 300,000 characters. Review the settings before running.\n\nNo additional settings are declared for this tool.\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nUp to 300,000 characters in total and 20,000 packages per lockfile. The comparison runs in your browser. Downloads: Markdown summary, JSON report and CSV.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"dependency-lockfile-diff\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"Up to 300,000 characters in total and 20,000 packages per lockfile. The comparison runs in your browser. Downloads: Markdown summary, JSON report and CSV.\",\n  \"implementation\": {\n    \"fields\": [],\n    \"registrationFamily\": \"project-snapshot-reference\",\n    \"inputMaxLength\": 300000,\n    \"inputErrorCode\": \"PROJECT_SNAPSHOT_REFERENCE_TOO_LONG\",\n    \"note\": \"Both lockfiles are compared on this device; no package registry is contacted.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": false,\n      \"inputMaxLength\": 300000,\n      \"inputMode\": \"text\",\n      \"label\": \"Two lockfiles\",\n      \"placeholder\": \"==> before/package-lock.json <==\",\n      \"help\": \"Paste the earlier lockfile first and the later one second, each after a ==> path <== line. Up to 300,000 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nCompare two lockfiles and see which packages were added, removed, upgraded or downgraded, split into direct and transitive dependencies.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use Dependency lockfile diff\n\n1. Paste the earlier lockfile after a line ==> before/package-lock.json <==.\n2. Paste the later lockfile after a line ==> after/package-lock.json <==.\n3. Run the comparison.\n4. Review the change table and download the Markdown, JSON or CSV report.\n\n## Useful next steps\n\n- [Semver Range Tester](https://happytails.ai/en/developer-tools/semver-range-tester/) ([Markdown](https://happytails.ai/en/developer-tools/semver-range-tester.md))\n\n- [SPDX Expression Validator](https://happytails.ai/en/developer-tools/spdx-expression-validator/) ([Markdown](https://happytails.ai/en/developer-tools/spdx-expression-validator.md))\n\n- [JSON diff](https://happytails.ai/en/developer-tools/json-diff/) ([Markdown](https://happytails.ai/en/developer-tools/json-diff.md))\n\n## What it does\n\nBoth lockfiles are parsed and every package name is compared by its set of locked versions. Single version changes are classed as upgrades or downgrades by Semantic Versioning 2.0.0 precedence; packages locked at several versions, versions that are not SemVer and versions that differ only in build metadata are reported as changed. Direct dependencies come from the root package entry, and transitive ones show the shortest chain of dependencies that brings them in. A package installed under an npm alias, such as lodash3 for npm:lodash@^3.10.0, is listed under its real name and counts as direct when the alias is.\n\n### Supported formats\n\npackage-lock.json and npm-shrinkwrap.json versions 1 to 3, yarn.lock classic and Berry, and pnpm-lock.yaml versions 5 to 9, including git, tarball and local file dependencies. The two files may use different formats. package-lock.json version 1 and yarn.lock classic have no root package entry, so their direct and transitive split shows as unknown unless a package.json is placed in the same folder as the lockfile.\n\n### Limits\n\nNothing is fetched from a registry, so the report only knows what the lockfiles contain. Introducing chains follow package names and do not model nested node\\_modules resolution; chains longer than 32 packages are flagged with their depth.\n"
}