Lerna: Lerna Bootstrap doesn't create a complete lock file

[jcousins-ynap]

If a package @test/one only has a dependancy on another lerna controlled package @test/two that package @test/one wil not have a lock file generated.

Expected Behavior

lerna bootstrap will output a package-lock.json for package @test/one

Current Behavior

lerna bootstrap does not output a package-lock.json for package @test/one

Possible Solution

¯\_(ツ)_/¯

Steps to Reproduce (for bugs)

1. clone https://github.com/jcousins-ynap/lerna-test.git
2. run lerna bootstrap in the repo root
3. run cat <repo-root>/packages/one/package-lock.json
4. witness the lack of @test/one

lerna.json

{
  "packages": [
    "packages/*"
  ],
  "version": "independent"
}

lerna-debug.log

n/a

Context

Unless my understanding is wrong, I expect the lock file to contain _all_ dependencies for a given package.

Your Environment

| Executable | Version |
| ---: | :--- |
| lerna --version | v3.16.4 |
| npm --version | v6.11.2 | |yarn --version|n/a| |node --version|node 12.7.0` |

| OS | Version |
| --- | --- |
| NAME | VERSION |
| macOS Sierra | 10.14.6 |

[jcousins-ynap]

It's likely that my understanding is wrong, but I guess I'm mainly looking for assurance.

Why do local packages get removed from other local packages lock files? (or not get added at all?)

[evocateur]

Yep, this is because lerna bootstrap is a hack you shouldn't use anymore (if you care about comprehensive lockfiles). Use yarn workspaces, pnpm recursive, or npm + relative file: dependency specifiers (like Lerna itself does).

[jcousins-ynap]

Please forgive if this sounds rude. Why is lerna bootstrap a hack? If it is, why does it still exist?