为什么我的yarn.lock中的包而不是我的package.json中的包？

Question

我用create-react-app启动了这个项目然后弹出。我目前正在分析我的网络包，我得到了这个。

我运行此命令来分析我的包 -

source-map-explorer main.<hash>.js main.<hash>.js.map

我有几个问题 -

1. 我在我的应用程序中使用了moment.js，但是在查看我的package.json时，它并不存在。它确实存在于我的yarn.lock中。为什么会这样？为什么我的应用程序工作？

2. 我使用lodash，但我已经注意导入特定的lodash函数（例如import map from "lodash/map"）。但是，我在我的node_module中看到了lodash。尽管从未导入过它。这为什么有效？是因为我的依赖关系依赖于整个lodash包而且我只是幸运吗？

3. 如何让source-map-explorer分析我的生产版本？我尝试了CRA文档中的步骤，但是它们出错了。

为什么会发生上述情况？

完整参考这里是我的package.json的依赖项/ devDependencies。

{
  "dependencies": {
    "autoprefixer": "7.1.6",
    "babel-core": "6.26.0",
    "babel-eslint": "7.2.3",
    "babel-jest": "20.0.3",
    "babel-loader": "7.1.2",
    "babel-polyfill": "^6.26.0",
    "babel-preset-react-app": "^3.1.0",
    "babel-runtime": "6.26.0",
    "case-sensitive-paths-webpack-plugin": "2.1.1",
    "chalk": "1.1.3",
    "cross-env": "5.1.4",
    "css-loader": "0.28.7",
    "dotenv": "4.0.0",
    "eslint": "4.10.0",
    "eslint-config-react-app": "^2.0.1",
    "eslint-loader": "1.9.0",
    "eslint-plugin-flowtype": "2.39.1",
    "eslint-plugin-import": "2.8.0",
    "eslint-plugin-jsx-a11y": "5.1.1",
    "eslint-plugin-react": "7.4.0",
    "extract-text-webpack-plugin": "3.0.2",
    "file-loader": "1.1.5",
    "fs-extra": "3.0.1",
    "html-webpack-plugin": "2.29.0",
    "jest": "20.0.4",
    "object-assign": "4.1.1",
    "postcss-flexbugs-fixes": "3.2.0",
    "postcss-loader": "2.0.8",
    "promise": "8.0.1",
    "query-string": "^5.1.0",
    "raf": "3.4.0",
    "react": "^16.2.0",
    "react-collapse": "^4.0.3",
    "react-countdown-now": "^1.3.0",
    "react-dev-utils": "^4.2.1",
    "react-dom": "^16.2.0",
    "react-grecaptcha": "^1.2.5",
    "react-md-spinner": "^0.2.5",
    "react-motion": "^0.5.2",
    "react-player": "^1.1.1",
    "react-redux": "^5.0.6",
    "react-responsive": "^4.0.3",
    "react-router-dom": "^4.2.2",
    "react-router-hash-link": "^1.2.0",
    "react-select": "^1.2.1",
    "redux": "^3.7.2",
    "redux-thunk": "^2.2.0",
    "style-loader": "0.19.0",
    "sw-precache-webpack-plugin": "0.11.4",
    "url-loader": "0.6.2",
    "webpack": "3.8.1",
    "webpack-dev-server": "2.9.4",
    "webpack-manifest-plugin": "1.3.2",
    "whatwg-fetch": "2.0.3",
    "xelpmoc-core": "^0.3.1"
  },
  "devDependencies": {
    "compression-webpack-plugin": "^1.1.3",
    "enzyme": "^3.3.0",
    "enzyme-adapter-react-16": "^1.1.1",
    "eslint": "^4.14.0",
    "eslint-config-recommended": "^2.0.0",
    "eslint-plugin-react": "^7.5.1",
    "google-map-react": "^0.34.0",
    "husky": "^0.14.3",
    "lint-staged": "^6.0.0",
    "pm2": "^2.9.1",
    "prettier": "^1.9.2",
    "redux-mock-store": "^1.4.0"
  },
}

Answer 1

yarn.lock是一个“锁定文件”，用于锁定您的依赖关系树，以便当另一个队友（或CI服务器）运行该构建时，它会获得相同的依赖关系（因此构建相同）。 lockfile不仅列出了依赖项，还列出了deps的deps。

NPM / yarn在可能的情况下使node_modules中的依赖项变平，因此您可能有一些依赖项正在安装lodash / moment。您可以通过运行npm ls lodash来调试它，以查看它的来源。你应该安装那些正在使用的软件包，但你已经“偶然”了。

我无法回答＃3