npm Lockfile Conflict Resolver
A line-based Git conflict in package-lock.json makes it hard to keep each package's version, download URL and integrity token together. This tool compares a common base with two npm v3 lockfile branches by package location. Independent edits merge automatically, while divergent edits at the same location require you to select the complete left or right record. It then checks required package locations and a bounded set of version ranges. The result is a review aid, not a guarantee that installation will succeed.
Key features
- Compare three npm package-lock.json v3 files against a common base
- Merge independent package locations and unrelated root dependency declarations
- Keep version, resolved URL and integrity together in each selected package record
- Block export when a required package is missing or a supported range conflicts
- Allow lockfile download only after every conflict is chosen and blocking issues are cleared
- Download a separate JSON report with decisions, unresolved items and warnings
How to use
- Select the pre-branch common package-lock.json v3 as Base and the two edited files as Left and Right.
- Analyze the three files and review automatically merged locations and conflicts requiring a decision.
- For each conflict, choose the branch whose complete package record or root declaration to retain.
- Review blocking issues; if necessary, correct a branch lockfile and run the analysis again.
- Download the merged file and review report, then validate them with your own package.json and npm workflow.
Use cases
- Combine branches that added different dependencies
- Review a Git conflict after two branches upgraded the same package differently
- Check selected root declarations against the resulting locked versions
- Record merge choices and remaining cautions for code review
Frequently asked questions
Can it merge Yarn, pnpm, Bun or package-lock v1/v2 files?
No. It accepts only npm package-lock.json with lockfileVersion 3 and a packages map. Other formats are rejected rather than converted silently.
What happens if both branches edit the same package?
You choose the complete package record from one branch. The tool never combines a version from one side with an integrity token from the other. A selected deletion is also kept as that branch represents it.
Does an available download mean npm ci will pass?
No. This tool checks only a bounded set of numeric version ranges and required package locations. Peer and optional dependencies, workspaces, platform conditions, npm flags and package.json alignment require separate checks in your project.
Does it prove which integrity token is correct?
No. If the same version and resolved URL have disagreeing integrity tokens, export is blocked. The tool neither downloads packages nor verifies their hashes; investigate externally and regenerate the lockfile.
Are the files uploaded?
No. Comparison runs in your browser. Each file may be up to 4 MiB, each lockfile up to 5,000 package locations, and the merge up to 1,000 conflicts. A downloaded result can still contain selected private registry URLs.
Privacy
The three files are read only in this browser tab. This tool does not send them to its server or contact an npm registry. A merged file or report is saved only when you choose to download it. Selected private registry URLs remain in the downloaded lockfile, so review it before sharing.
Comments & questions