All tools

Lockfile Duplicate Version Reporter

Code

Parse an npm (package-lock.json), yarn (yarn.lock), or pnpm (pnpm-lock.yaml) lockfile and report every package installed at more than one resolved version, with each version's count of install locations

Paste the contents of an npm package-lock.json, a yarn yarn.lock, or a pnpm pnpm-lock.yaml and see every package that's installed at more than one resolved version, the classic reason a bundle is bigger than expected or two copies of the same library end up in a build. The format is auto-detected from the file's own content, and each duplicated package lists every version found along with how many install locations in the lockfile resolve to it. This is distinct from the package.json Dependency Range Auditor, which checks the version ranges you declared, not what actually got installed and resolved.

lockfilenpmyarnpnpmdependenciesnodebundle-size

How to use Lockfile Duplicate Version Reporter

  • 1.Paste the full contents of your package-lock.json, yarn.lock, or pnpm-lock.yaml.
  • 2.Optionally force a format instead of relying on auto-detection.
  • 3.Review the duplicate packages list: each one shows its versions and how many install locations resolve to each.

Frequently asked questions

Does this tell me which package required the duplicated version?
No, the count reflects how many install locations in the lockfile resolve to that version, not which specific dependency requested it. For that level of detail, use npm ls <package> or pnpm why <package> against the actual installed tree.
Is having two versions of the same package always a problem?
Not necessarily. Package managers deduplicate when they safely can, and some duplication is expected when dependencies genuinely require incompatible version ranges. It's worth investigating when you see a large or unexpectedly duplicated package, especially one with side effects like a UI framework.
Does it work with pnpm lockfiles older than v6?
No. pnpm versions before v6 keyed packages with a slash before the version instead of "name@version", and that older format isn't supported; re-generate the lockfile with a current pnpm version first.
Is my lockfile uploaded anywhere?
No, parsing runs entirely in your browser. Nothing is sent to a server or stored.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/lockfile-duplicate-version-reporter \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"lockfile":"{\"name\":\"app\",\"lockfileVersion\":3,\"packages\":{\"\":{\"name\":\"app\"},\"node_modules/lodash\":{\"version\":\"4.17.21\"},\"node_modules/foo/node_modules/lodash\":{\"version\":\"3.10.1\"}}}"}'

Get an API key from your dashboard · Full API docs →

Related tools

package.json Dependency Range AuditorParse a package.json's dependencies, devDependencies, peerDependencies, and optionalDependencies fields and classify each version specifier's range type, flagging wildcard ranges, the "latest" tag, git/URL/file/link dependencies, and packages listed with conflicting ranges across sectionsCodepackage.json "exports" Field ValidatorParse a package.json's exports map and flag common dual-package (ESM/CJS) misconfigurations: a types condition not listed first, a missing default fallback, mismatched require/import extensions, mixed subpath and condition keys, and a subpath pattern with no matching *Code