Implementation:Puppeteer Puppeteer Root Package Lock

Attribute	Value
sources	Puppeteer_Puppeteer|https://github.com/puppeteer/puppeteer
domains	Build_System, Dependency_Management
last_updated	2026-02-12 00:00 GMT

Overview

The root package-lock.json is the npm lockfile for the Puppeteer monorepo, pinning exact versions of all transitive dependencies across all workspace packages to ensure deterministic and reproducible builds.

Description

This file is an auto-generated npm lockfile (lockfileVersion 3) for the monorepo named puppeteer-repo. It captures the entire resolved dependency tree for the root project and all its npm workspaces:

• packages/* -- Core library packages (puppeteer, puppeteer-core, browsers, etc.)
• test and test/installation -- Test infrastructure
• tools/eslint, tools/doctest, tools/docgen, tools/mocha-runner -- Internal tooling

The root devDependencies include build tools (esbuild, rollup, typescript), testing frameworks (mocha, sinon, expect), linting (eslint, prettier), and task orchestration (wireit, hereby). At approximately 32,344 lines, it records the resolved registry URL, integrity hash, and dependency graph for every installed package.

Usage

This file is consumed automatically by npm install (or npm ci) to install exact dependency versions. It should never be edited manually. It is regenerated whenever dependencies change in any package.json within the monorepo.

Code Reference

Source Location

File	Purpose
package-lock.json	Root monorepo npm dependency lockfile (32,344 lines)
package.json	Root package manifest defining workspaces and devDependencies

I/O Contract

The file is a JSON document conforming to the npm lockfileVersion 3 schema.

Top-level structure:

{
  "name": "puppeteer-repo",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": { ... },                          // Root package metadata (workspaces, devDependencies)
    "node_modules/<package-name>": {      // Per-dependency entry
      "version": "<semver>",
      "resolved": "<registry-url>",
      "integrity": "<sha512-hash>",
      "dependencies": { ... },
      "engines": { ... }
    }
  }
}

Key fields per dependency entry:

Field	Type	Description
version	string	Exact resolved semver version
resolved	string	Full URL to the package tarball on the npm registry
integrity	string	Subresource integrity hash (SHA-512) for verification
dependencies	object	Nested dependency version constraints specific to this package
engines	object	Node.js engine constraints (if declared by the package)

Usage Examples

Installing exact pinned dependencies (CI recommended):

npm ci

Regenerating the lockfile after a dependency change:

npm install

Inspecting a specific dependency version:

cat package-lock.json | jq '.packages["node_modules/typescript"].version'
# "5.8.3"

Related Pages

• Website Package Lock -- Separate lockfile for the documentation website
• Versions Map -- Mapping of Puppeteer versions to browser versions