How to fix package-lock.json merge conflicts (and yarn.lock, poetry.lock, go.sum) the right way
You rebase on main and git stops: CONFLICT (content): Merge conflict in package-lock.json The usual reflexes are all wrong: Hand-editing the markers away gives you a dependency tree no resolver would produce. "Accept Both Changes" leaves duplicate JSON keys or invalid TOML/YAML. Accepting one side looks fine, but the other branch's new dependencies are silently missing from the lock. The rule A…
When you rebase on the main branch and encounter a merge conflict in a lockfile, such as package-lock.json, the usual reflexes are misguided. Simply hand-editing the markers or accepting both changes results in an inaccurate dependency tree. While one side may appear correct, the other branch's new dependencies are missed from the lockfile.
A lockfile is essentially the build output of the manifest, so resolving the manifest manually is necessary. Following this, give the tool a lockfile it can read and let it regenerate the lockfile. Both npm, Yarn, and pnpm can read a conflicted lockfile and merge both sides. For other tools like Cargo, one clean side of the lockfile is required first.
The table of lockfiles is as follows:
- npm: `npm install --package-lock-only --ignore-scripts`
- Yarn (v1): `yarn install --ignore-scripts`
- Yarn (berry): `yarn install --mode=update-lockfile`
- pnpm: `pnpm install --lockfile-only --ignore-scripts`
- poetry: `poetry.lock --ours poetry lock` or `poetry lock --no-update` (for Poetry 1)
- uv: `uv.lock --ours uv lock`
- Cargo: `cargo update --workspace`
- go: `go mod tidy`
- composer: `composer update --lock --no-install --no-scripts`
- Gemfile.lock: `bundle lock`
- Pipfile.lock: `pipenv lock`
During a rebase, `--ours` refers to the branch you rebase onto, not your branch. For Cargo, avoid `cargo generate-lockfile` as it performs upgrades, turning a merge into an upgrade. The `--ignore-scripts` flag is intentional, as you are regenerating a lockfile, not building, so there's no need to run install scripts from packages you haven't reviewed.
VS Code has a free extension called LockSettle that automates this process. It flag conflicted lockfiles (including in monorepos), refuses to proceed if the manifest is still conflicted, displays the exact command in a confirmation dialog, runs it as a visible task in the right folder, and checks for leftover markers before staging the file.
All commands are overridable, and the extension does not require network access or telemetry, ensuring safe operation within a workspace. You can find it on VS Code marketplace using `code --install-extension jaytankdev.locksettle`.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
