[RRFC] Support installing from only a lock file

Motivation ("The Why")

When developing in a docker environment, rebuilding images and installing dependencies can be quite slow. Using best practices it is recommended to have a docker file with the following steps:

1. Copy package.json and package-lock.json files into image
2. Install dependencies
3. Copy rest of application

Doing it this way ensure that we can skip step 2 if nothing has changed in step 1. Ideally this means that step 1 should only contain the minimum to install the dependencies in step 2.

For npm v9 the minimum needed to be able to install dependencies in a production like setting such as a docker file is both the package.json and package-lock.json.

Relying on package.json has some downsides because it is used for a lot of other configuration:

• npm scripts
• eslint configuration
• jest configuration
• repository and licence information.

If any of these change then step 2 of the docker build cannot be skipped.

Example

• Solving this would speed up docker builds for people where package.json has changed but package-lock.json has not changed.

How

Current Behaviour

• Currently both package.json and package-lock.json is needed to be able to install packages.

Trying to install with only a package-lock.json file present results in the following error:

npm ERR! code ENOENT
npm ERR! syscall open
npm ERR! path /path/package.json
npm ERR! errno -2
npm ERR! enoent ENOENT: no such file or directory, open '/path/package.json'
npm ERR! enoent This is related to npm not being able to find a file.
npm ERR! enoent 

Desired Behaviour

• npm install should support installing from only a package-lock.json
• npm ci should support installing from only a package-lock.json.

References

• Potentially related RRFC https://github.com/npm/rfcs/issues/415
• Recommended docker file for node

Start by reviewing the package.json and package-lock.json assumptions for npm install and npm ci, then compare the related RRFC #415. Done means both commands can install dependencies when only package-lock.json is present, without the current package.json ENOENT error.