package-lock.json migration from npm v6 to v7+ lockfileVersion 2

Short answer

There is no npm configuration flag that stops v7+ from rewriting package-lock.json to lockfileVersion: 2. The upgrade happens automatically on any npm install that detects an outdated lockfile.

Why the upgrade occurs

When npm v7+ runs, it checks the existing lockfile. If the file is missing or its lockfileVersion is lower than 2, npm treats it as out‑of‑date and writes a new lockfile using the v2 format (which includes the deduplication section and other v2‑specific fields). This behavior is hard‑coded; no npm config option overrides it.

Recommended strategy for mixed‑version environments

1. Standardise on npm v6 for all installations – Ensure every developer machine, local workflow, and CI job runs npm v6.x. With v6 the lockfile stays at version 1, so no mutation occurs.
2. Use an engines constraint to enforce the version – Add "engines": { "npm": "<7" } to package.json. Most CI systems will respect this and fail early if a newer npm is attempted.
3. Prefer npm ci over npm install for reproducible builds – npm ci will never rewrite the lockfile; it only verifies that the lockfile matches package.json. If you run npm ci with npm v6, the lockfile remains unchanged.
4. If you must run npm v7+ in some contexts, lock the lockfile manually – Before running any v7+ command, execute npm install --package-lock-only --legacy-bundling with npm v6 to generate a v1 lockfile, then commit it. Subsequent v7+ runs that only read the lockfile (e.g., npm ci) will not modify it.

Verification steps

• Run npm --version to confirm you are using v6.x.
• Check package-lock.json for the line "lockfileVersion": 1.
• After running npm ci, diff the lockfile; it should be identical to the pre‑run version.