package-lock.json: use OS-independent path separators for file packages

[Meligy]

Hello,
This is essentially the issues discussed npm/npm#17338 which I think was closed based on a misunderstanding (or the code was not relevant to actual issue). It's also 4 years old and the whole repository is archived.

Let's say I'm running on Windows and I have a file package in package.json, like:

"dependencies": {
  "@mobiscroll/react": "file:lib\\mobiscroll-react-5.10.0.tgz"
  //...
}

Now, another developer who uses macOS or Linux updates the package version, or simply runs npm install.

Currently, it will cause package-lock.json to show like this in git:

The issue here is that package-lock.json is using OS-dependent path separators.

I understand that package-lock is meant to be as specific as possible. That's why it has the registry for example and integrity hash, but I'd argue if we are referring to the same files in both OSes, then the separator does not need to be OS dependent.

So, my proposal is to always use the same path separator / for file packages, even on Windows.

If in doubt, we can have a config value controlling it, so that those who want to change the behaviour can have it in their .npmrc file.

It's a fairly safe change as the CLI today already recognises the right package on running npm install and loads the same file regardless of the OS and updates the package-lock.json accordingly.