Dependency lockfile diff
Compare two lockfiles and see which packages were added, removed, upgraded or downgraded, split into direct and transitive dependencies.
Up to 300,000 characters in total and 20,000 packages per lockfile. The comparison runs in your browser. Downloads: Markdown summary, JSON report and CSV. Paste the earlier lockfile first and the later one second, each after a ==> path <== line. Up to 300,000 characters. Review the settings before running.
Your result
How to use Dependency lockfile diff
- Paste the earlier lockfile after a line ==> before/package-lock.json <==.
- Paste the later lockfile after a line ==> after/package-lock.json <==.
- Run the comparison.
- Review the change table and download the Markdown, JSON or CSV report.
Useful next steps
What it does
Both lockfiles are parsed and every package name is compared by its set of locked versions. Single version changes are classed as upgrades or downgrades by Semantic Versioning 2.0.0 precedence; packages locked at several versions, versions that are not SemVer and versions that differ only in build metadata are reported as changed. Direct dependencies come from the root package entry, and transitive ones show the shortest chain of dependencies that brings them in. A package installed under an npm alias, such as lodash3 for npm:lodash@^3.10.0, is listed under its real name and counts as direct when the alias is.
Supported formats
package-lock.json and npm-shrinkwrap.json versions 1 to 3, yarn.lock classic and Berry, and pnpm-lock.yaml versions 5 to 9, including git, tarball and local file dependencies. The two files may use different formats. package-lock.json version 1 and yarn.lock classic have no root package entry, so their direct and transitive split shows as unknown unless a package.json is placed in the same folder as the lockfile.
Limits
Nothing is fetched from a registry, so the report only knows what the lockfiles contain. Introducing chains follow package names and do not model nested node_modules resolution; chains longer than 32 packages are flagged with their depth.