package-lock.json file explained

Key Takeaways

All right, guys. So, what the hell's with this package-lock.json file that keeps showing up in your projects? So, you're working on a node project. You install some packages with npm and boom, this massive file appears. Should you commit it, delete it? What's it even doing? So, here's the deal. When you run npm install, npm looks at your package.json for dependencies. But here's the problem. If I say I want React version carrot 18.2.0, that could install 18.2.5. 2.5, 18.2.8, whatever the latest patch is. So, package lock.json locks down the exact version that got installed and every single dependency, every subd dependency gets pinned to a specific version. Why does that matter? Because when your teammate clones your repository, when you deploy to production, npm reads this lock file first. Everyone gets the identical dependency tree, and there's no more works on my machine nonsense. And yes, always commit your package lock.json.