Locking App Node Modules

[farhanpatwary]

Locking App Node Modules

Current Setup:

We have an NX Monorepo with a top-level package.json and yarn.lock

Currently, when deploying an application or library, we have an nx build step in which we build the app and generate a package.json file.

This is a simplified example of what our workspace looks like:

.
├── README.md
├── apps
│   ├── app1
├── dist
│   └── apps
│       └── app1
│           ├── node_modules
│           ├── package.json
│           └── public
├── nx.json
├── package-lock.json
├── package.json
├── workspace.json
└── yarn.lock

Upon deployments, node modules aren’t being locked due to the lack of yarn.lock in the dist folder.

This is a problem because it means that locally, we may install different versions of a package than on a production build which may result in slightly different behaviour within the app.

We are looking for recommendations on how to lock node_modules within the app build.