lockdiff

Human-readable diffs for package-lock.json changes between git refs. Perfect for PR reviews and CI pipelines.

Install

npm install -g @aaaaorg/lockdiff
# or use directly
npx @aaaaorg/lockdiff main

Usage

# Compare current lockfile vs a branch/tag
lockdiff main
lockdiff v1.0.0

# Compare two specific refs
lockdiff v1.0.0 v2.0.0

# Compare two files directly
lockdiff --file old-lock.json new-lock.json

# Output as markdown (great for CI PR comments)
lockdiff main --format markdown

# Output as JSON
lockdiff main --format json

# Only show major version bumps
lockdiff main --major-only

Example Output

📦 lockdiff: main → HEAD

  ➕ Added (3):
    zod                                      3.22.4
    @types/node                              20.11.5
    prettier                                 3.2.4

  ⬆️  Upgraded (2):
    typescript                               5.3.2 → 5.3.3
    eslint                                   8.56.0 → 9.0.0  (MAJOR)

  ⬇️  Downgraded (1):
    webpack                                  5.90.0 → 5.89.0

  ➖ Removed (1):
    tslint                                   6.1.3

  Summary: +3 added, 2 upgraded (1 major), 1 downgraded, 1 removed

CI Integration

Add to your GitHub Actions workflow to auto-comment lockfile changes on PRs:

- name: Lockfile diff
  run: npx @aaaaorg/lockdiff origin/main --format markdown >> $GITHUB_STEP_SUMMARY

Programmatic API

import { parseLockfile, diffDeps, format } from '@aaaaorg/lockdiff';

const oldDeps = parseLockfile(oldLockContent);
const newDeps = parseLockfile(newLockContent);
const result = diffDeps(oldDeps, newDeps);
console.log(format(result, 'table', 'v1', 'v2'));

Supports

• package-lock.json v1, v2, and v3
• Scoped packages (@scope/package)
• Major version bump detection

License

MIT