DEV Community

Discussion on: But what the hell is package-lock.json?

Collapse
 
sir_wernich profile image
Wernich ️ • Edited

this is so far the best explanation i've read of what this file does. i'm assuming the reason why this file changes so much in our repo is because people are constantly upgrading npm packages? we've had many merge conflicts around that file, so it eventually got added to gitignore.

i didn't hear the whole conversation, but it sounded like one of our test deploys failed miserably because of npm package changes somewhere. could probably have been avoided then.

Collapse
 
saurabhdaware profile image
Saurabh Daware 🌻 • Edited

I think my this comment will explain a lot of extra things dev.to/saurabhdaware/comment/eoo4

So basically there are few cases when package-lock.json changes

  1. You npm install --save <package> so it updates the package to absolute latest version changing the version inside package.json and package-lock.json
  2. When package.json changes: So when you (or let's say dependabot or your other teammate) changes the version of the package in package.json npm install will look into package.json for the version and will update the package-lock.json with respect to package.json

Also gitignoring package-lock is kind of risky unless you have any other workaround it

And thank you for reading! I am super happy to see that you found it useful :D