#17615 NpxToolBase should support lockfiles Issue created by sureshjoshi From: #17557 NpxToolBase supports changing versions, but needs lockfile support. Quoting myself:

npx is a bit weird (as is npm exec in my opinion).

It maintains its own cache and looks for local node_modules wherever it can. So, npx cowsay will ask to install 1.5.0 - but if I want to lock that to using a lockfile, I need to do npm install cowsay (generates package-lock.json) and then npx cowsay will use that local version in the node_modules.

So, lockfiles == good, but a bit of work here, unless there is an npx input to use a lockfile directly - but I just ran some tests that didn't work, nor can I find any docs on this subject right now.

pantsbuild/pants