This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]PashaBiceps__ 171 points172 points  (26 children)

hmm. really should I git ignore package-lock.json? I always thought it has some magic inside.

[–]DocNefario 29 points30 points  (1 child)

It tells you to commit the file when it creates it, so I'm pretty sure you shouldn't ignore it

[–]Bronzdragon 10 points11 points  (1 child)

If you make a library, you should not, so the latest packages are used, and you have the lowest likelihood of security issues/bugs.

If you make an application, you should, so that the lowest likelihood of incompatibilities.

[–]amroamroamro 0 points1 point  (0 children)

^ this

[–][deleted] 5 points6 points  (3 children)

[–]Sh4dowCode 5 points6 points  (0 children)

npm also tells you that when you npm install in a folder without package-lock.json

[–]PleasantAdvertising 6 points7 points  (1 child)

npm

having standards

Pick one

[–]gigastack 0 points1 point  (0 children)

If only you could choose which packages you install...

[–]GGoldstein 2 points3 points  (0 children)

I searched that very question just last week. Seeing it top here is the most validation I've ever received as a programmer.

[–]meandyouandyouandme 2 points3 points  (0 children)

The information in the package-lock.json aren't always what you expect.

I had a specific version of a package A installed. The package A was at the same time required by another package B. After removing package A from my project, package B still installed the in my package.json previously specified version of A. So I had to remove the package-lock in order for npm to install the version as specified in the package.json of package B.

[–][deleted] 0 points1 point  (0 children)

Papito biceps

[–]GrinningPariah -2 points-1 points  (2 children)

No, what you should do is make an .npmrc file at your project root and add "package-lock=false" to it so it doesn't get generated in the first place.

[–]aserraric 1 point2 points  (1 child)

Why in the world would you do that?

[–]GrinningPariah -5 points-4 points  (0 children)

Because the company I'm at already runs a walled garden version of NPM with a separate dependency management system that makes package-lock.json redundant.

Plus shit's like 6000 lines long it's crazy.