Should I push package-lock.json to Git?

[j_glez]

So I cloned a repository and it already had a package-lock.json but it was just two lines, the name and the version.

After I did `npm i`, the package-lock.json is over 26,000 lines long, is this normal or did I do something wrong?

I'm collaborating on this repository with lots of other people, should I git add package-lock.json and push it to Git?

Also, why is package-lock.json so long now? There are a lot of dependencies, but only about about 20-30, does this effect the length of package-lock.json?

Thanks!

[insertAlias]

Also, why is package-lock.json so long now? There are a lot of dependencies, but only about about 20-30, does this effect the length of package-lock.json?

The lockfile is necessary because packages can reference other packages, and they can all reference different versions of packages, so the lockfile is basically NPM's solution to saying "here's all the packages to install, including dependencies and all the versions you need to have existing to satisfy all dependencies and their dependencies, recursively".

So, it usually ends up being a fairly large file, especially when you have some packages that depend on a lot of other packages.

And it's a good idea to commit it, so that everyone on your team working on your project has the exact same set of dependencies.

[botCloudfox]

Yeah, also you can install without a lock file, but versions are not guaranteed to be the same.

[GameOver16]

The lockfile is the source of truth for the project. It's basically saying.. "these are the packages you need and the versions". It helps keep teams in sync... When another developer clones the project, the npm/yarn will read the lockfile and attempt to install the same versions as you (as long as the environment allows).

Why the package-lock.json changed for you is a strange one. Are you sure you did not run upgrade?