lockfile-affected

Warning: This tool is still in early development. The API may change, and some features are incomplete or not yet fully tested. Use in production at your own risk.

Find which workspace packages are affected by lockfile changes.

Purpose

In monorepos, it is hard to build automation that reacts reliably to transitive dependency updates recorded only in lockfiles.

That gap can prevent dependency and security fixes from being rebuilt, retested, and deployed in the workspace packages they actually impact.

lockfile-affected maps lockfile deltas to affected workspace packages so Git and CI pipelines can react deterministically.

Installation

Install globally when you want a persistent lockfile-affected command:

npm install -g lockfile-affected
# or
pnpm add -g lockfile-affected

Install in a repository:

pnpm add -D lockfile-affected

Usage

Pass the before and after lockfile snapshots as arguments. Use shell process substitution to avoid temp files:

# Compare against a specific branch
lockfile-affected <(git show origin/main:pnpm-lock.yaml) pnpm-lock.yaml

# Compare against the merge base (typical CI usage)
BASE=$(git merge-base HEAD origin/main)
lockfile-affected <(git show $BASE:pnpm-lock.yaml) pnpm-lock.yaml

Or pipe the before snapshot via stdin using - (works with npx):

git show origin/main:pnpm-lock.yaml | npx lockfile-affected - pnpm-lock.yaml

Works with pnpm, npm, yarn (classic v1 and berry v2+), and Bun lockfiles (bun.lock). Format is auto-detected from content, or use --format to override.

Options

--workspace <path>         Root directory to search for package.json files (defaults to cwd)
--format <pnpm|npm|yarn|bun> Lockfile format override (auto-detected from content by default)
--json                     Output as a JSON array instead of newline-separated
--deps                     Include production dependencies
--dev                      Include dev dependencies
--peer                     Include peer dependencies
--optional                 Include optional dependencies
                            (when no dep flags are set, all types are included)
--root-deps-affect-all     Treat root dependency changes as affecting all packages
--order <alphabetical|topological> Output order (default: alphabetical)
--help                     Show help

Related packages

• @lockfile-affected/core — programmatic API, pure diff and resolution engine
• @lockfile-affected/lockfile-pnpm — pnpm-lock.yaml parser
• @lockfile-affected/lockfile-npm — package-lock.json parser
• @lockfile-affected/lockfile-yarn — yarn.lock parser
• @lockfile-affected/lockfile-bun — bun.lock parser