# Lockfile Diff & Dependency Tree

Compare two lockfiles to see which packages were added, removed or upgraded. You can also see why a package is installed and where several versions of one package come from. Nothing leaves your browser.

- URL: https://tools.itlibra.com/en/dependency-viewer
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Choose a package-lock.json, yarn.lock or pnpm-lock.yaml file, or paste its text. The format is detected automatically.
2. In “Dependency tree”, expand from the direct dependencies or search by name. “Why installed” shows the path from a direct dependency to the package.
3. In “Duplicates”, check packages installed in more than one version and the packages that pull each version in.
4. In “Diff”, choose the updated lockfile too and press “Analyze”. Upgrades, downgrades, added and removed packages, sources and integrity changes are listed.
5. Use “Save CSV” to take every diff row into a spreadsheet.

## Use cases

- See how package-lock.json changed after npm install
- Check why an indirect dependency is in the project
- List the versions actually raised in a Dependabot or Renovate update pull request
- Find a library that is installed in several versions
- Check changed sources or hashes in a yarn or pnpm lockfile

## What it does

### Tree that separates direct and indirect

Tells apart dependencies, devDependencies, optionalDependencies and peerDependencies, and expands from the project’s direct dependencies. A peer is shown only where it is installed.

### Why it is installed, as a path

Walks back from a package through its dependents and shows the shortest path to a direct dependency.

### Detects the format

Reads npm lockfileVersion 1, 2 and 3, yarn v1 and Berry (v2 and later), and pnpm 5, 6 and 9. Unsupported files show the reason.

### Diff by semver

Compares versions of the same package with semver and separates upgrades from downgrades. Major upgrades are highlighted as warnings.

### Warns on integrity mismatch

Warns when the version is the same but the integrity (hash) differs. Also shows when a source moves to another host.

### Fully local

Parsing runs in a Web Worker inside your browser. Neither the lockfile nor its file name is sent or logged.


## Supported formats

### Read

- package-lock.json (lockfileVersion 1, 2 and 3)
- yarn.lock (yarn v1 format and the YAML format of yarn v2 and later)
- pnpm-lock.yaml (lockfileVersion 5, 6 and 9)

### Output

- On-screen lists
- Diff as CSV (UTF-8 with BOM)


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Dependency tree (direct and indirect) | Partial | npm v1 and yarn v1 do not record direct dependencies, so they cannot be told apart |
| Why a package is installed (dependents path) | Supported | Shows one shortest path, not every path |
| Several versions of the same package | Supported | — |
| Diff of two lockfiles (added, removed, upgraded, downgraded) | Supported | — |
| Changes in source (resolved) and integrity | Partial | Sources are not compared when the two lockfiles use different formats |
| Vulnerability lookup | Not supported | It needs an outside connection, so it is not done |
| License review | Not supported | — |
| Analysis from package.json alone | Not supported | Reads the lockfile |
| Installing packages or generating a lockfile | Not supported | — |
| Offline use | Supported | Works without a connection once loaded |

## Limits & notes

- Files up to 50 MB each. Pasted text up to 2 million characters.
- A lockfile with more than 100,000 packages is not read.
- On screen: up to 200 search results, 300 duplicated packages and 5,000 diff rows. The CSV contains every diff row.
- Only the lockfile contents are read. The node\_modules folder and the versions actually running are not checked.
- npm workspace links are not included in the list.

## Privacy & safety

Lockfiles are analyzed only inside your browser. Nothing is uploaded or stored, and file names and contents are never put in analytics logs. Closing the page discards everything.

## FAQ

### How do I diff two package-lock.json files?

In the Diff tab, choose the older and newer package-lock.json and press “Analyze”. Added, removed and upgraded or downgraded packages are listed, and major upgrades are highlighted as warnings.

### Can it show why a package is installed?

Yes. Search for the package in the dependency tree and press “Why installed” to see the shortest path from a direct dependency to it.

### Does it read yarn.lock and pnpm-lock.yaml?

Yes. The format is detected automatically. yarn v1 and npm v1 do not record direct dependencies, so direct and indirect cannot be told apart for them.

### Does it check vulnerabilities or licenses?

No. A vulnerability lookup needs an outside connection, so it is not done, and licenses are not checked. Use a dedicated tool for those.

### What does an integrity change mean?

It warns when the version is the same but the integrity (hash) differs. This can be a re-publish, a mirror difference or tampering, so check it together with the source.

### Is my lockfile sent anywhere?

No. Everything runs in your browser. Nothing is sent to LIBRA Works or any third party.