What is project.lock.json?

Question

I followed the instruction to create new .NET Core project and ran this from cmd:

dotnet new
dotnet restore

The second statement creates project.lock.json that contains a lot of garbage (not really garbage but tons of dependencies, configurations etc.). I assume these dependencies is .NET framework that is broken down into separate NuGet packages.

My questions:

1. Is my assumption correct?
2. Can I make my application lighter by removing not needed NuGet packages/dependencies?
3. How?

Answer 1

Update: project.json has been replaced with .csproj as the main project file for .NET Standard projects. This question refers to the old system before the introduction of PackageReference in NuGet 4.0.

You may still occasionally see project.lock.json as an artifact of the build process, but it should be ignored. Managing the NuGet packages that your .NET Standard/.NET Core project depends on should always be done by either

• Editing the .csproj file directly
• Using the dotnet CLI (dotnet add package, etc)
• Using the Package Manager GUI if you're using Visual Studio

---

Old answer for posterity: project.lock.json is generated by the .NET tooling when you restore the project's packages. You shouldn't touch it or check it into source control. Edit project.json directly.

During the package restore process (dotnet restore), NuGet has to analyze the dependencies in your project, walk their dependency graphs, and figure out what packages should be installed for your project and your project's dependencies.

This is a non-trivial amount of work, so the results are cached in project.lock.json to make subsequent restores faster and more efficient. The lock file will be regenerated if project.json is modified and dotnet restore is executed again.

Answer 2

Every so often, in our team, when someone updates some nuget, we have the same problem, the lock.json files doens't get updated, even running dotnet restore so, before applying the last choice (deleting them) I suggest run grunt from your command line. If that doesn't work, delete all the lock.json files and run dotnet restore, this is my favourite choice ;)