为什么包在我的yarn.lock中而不在我的package.json中？

Question

我用create-react-app开始这个项目，然后弹出。我正在分析我的webpack包，我得到了这个。

我运行这个命令来分析我的捆绑包-

source-map-explorer main.<hash>.js main.<hash>.js.map

我有几个问题-

>

我在我的应用程序中使用了moment.js，但是当查看我的package.json时，它不在那里。它确实存在于我的纱锁里。为什么会出现这种情况？为什么我的应用程序还能工作？

我使用lodash，但我已经注意导入特定的lodash函数（例如从“lodash/map”导入map)。然而，我在node_module中看到了lodash。为什么这起作用了？是不是因为我的一个依赖关系对整个lodash包都有依赖关系，而我只是在走运？

我如何让source-map-explorer来分析我的生产版本？我尝试了CRA文档中的步骤，但它们出错了。

为什么会出现上述情况？

这里是我的package.json的dependencies/devdependencies。

{
  "dependencies": {
    "autoprefixer": "7.1.6",
    "babel-core": "6.26.0",
    "babel-eslint": "7.2.3",
    "babel-jest": "20.0.3",
    "babel-loader": "7.1.2",
    "babel-polyfill": "^6.26.0",
    "babel-preset-react-app": "^3.1.0",
    "babel-runtime": "6.26.0",
    "case-sensitive-paths-webpack-plugin": "2.1.1",
    "chalk": "1.1.3",
    "cross-env": "5.1.4",
    "css-loader": "0.28.7",
    "dotenv": "4.0.0",
    "eslint": "4.10.0",
    "eslint-config-react-app": "^2.0.1",
    "eslint-loader": "1.9.0",
    "eslint-plugin-flowtype": "2.39.1",
    "eslint-plugin-import": "2.8.0",
    "eslint-plugin-jsx-a11y": "5.1.1",
    "eslint-plugin-react": "7.4.0",
    "extract-text-webpack-plugin": "3.0.2",
    "file-loader": "1.1.5",
    "fs-extra": "3.0.1",
    "html-webpack-plugin": "2.29.0",
    "jest": "20.0.4",
    "object-assign": "4.1.1",
    "postcss-flexbugs-fixes": "3.2.0",
    "postcss-loader": "2.0.8",
    "promise": "8.0.1",
    "query-string": "^5.1.0",
    "raf": "3.4.0",
    "react": "^16.2.0",
    "react-collapse": "^4.0.3",
    "react-countdown-now": "^1.3.0",
    "react-dev-utils": "^4.2.1",
    "react-dom": "^16.2.0",
    "react-grecaptcha": "^1.2.5",
    "react-md-spinner": "^0.2.5",
    "react-motion": "^0.5.2",
    "react-player": "^1.1.1",
    "react-redux": "^5.0.6",
    "react-responsive": "^4.0.3",
    "react-router-dom": "^4.2.2",
    "react-router-hash-link": "^1.2.0",
    "react-select": "^1.2.1",
    "redux": "^3.7.2",
    "redux-thunk": "^2.2.0",
    "style-loader": "0.19.0",
    "sw-precache-webpack-plugin": "0.11.4",
    "url-loader": "0.6.2",
    "webpack": "3.8.1",
    "webpack-dev-server": "2.9.4",
    "webpack-manifest-plugin": "1.3.2",
    "whatwg-fetch": "2.0.3",
    "xelpmoc-core": "^0.3.1"
  },
  "devDependencies": {
    "compression-webpack-plugin": "^1.1.3",
    "enzyme": "^3.3.0",
    "enzyme-adapter-react-16": "^1.1.1",
    "eslint": "^4.14.0",
    "eslint-config-recommended": "^2.0.0",
    "eslint-plugin-react": "^7.5.1",
    "google-map-react": "^0.34.0",
    "husky": "^0.14.3",
    "lint-staged": "^6.0.0",
    "pm2": "^2.9.1",
    "prettier": "^1.9.2",
    "redux-mock-store": "^1.4.0"
  },
}

Answer 1

lock是一个“lockfile”，它锁定依赖关系树，这样当另一个队友（或CI服务器）运行构建时，它就会得到相同的依赖关系（从而得到相同的构建）。lockfile不仅列出依赖项，还列出deps的deps。

npm/yarn尽可能地将node_modules中的依赖项变平，因此您可能有一些依赖项，即安装lodash/moment。您可以通过运行npm ls lodash来调试它，查看它的来源。您肯定应该安装那些您正在使用的软件包，但您“意外”得到了这些软件包。

我不能回答第三个问题