[BUG] package-lock.json contains too many details about the current package.

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

The package-lock.json file includes the current package name ($.name), version ($.version), the a current package entry ($.packages[""]).

This has the following negative side effects:

• It seems less than portable, if for instance I wanted to start another project out with the same set of locked versions by copying the lock file.
• The lock file can become out of sync with package.json if non-dependency change are made to the package and npm i is not run. Running npm i updates the current package related values in the lock file.

I don't see why the lock file would need these details. It's not necessary to "lock" them. They are available in package.json already, and the lock file is tightly associated with the package file by being adjacent.

Expected Behavior

The current package specific details should be omitted from the package-lock.json so that running npm i after changing the package.json name or version, does not update the lock file.

Steps To Reproduce

Run npm i
Commit the package-lock.json file.
Update package.json version.
Run npm i again
Note the lock file has changes.

Environment

• npm: 8.5.5
• Node.js: 16.13.2
• OS Name: macOS 12.4
• System Model Name: Macbook Pro M1
• npm config:

; No, and asking people to post system specific details in a public forum, is shady.

The issue names package.json and package-lock.json; start by reproducing the reported npm i sequence and comparing the lock file before and after changing the package version. Done means npm no longer rewrites current-package details in package-lock.json for those changes, while dependency locking remains intact.