Why does "npm install" modify package-lock.json? Why commit it to git then?

10
votes

When I run "npm install" in a project it often modifies package-lock.json, for example if I work on the same project from another computer (with different node or npm version).

But at the same time the documentation suggests that the file is supposed to be added to version control (git in my case):

https://docs.npmjs.com/files/package-lock.json

This file is intended to be committed into source repositories, and serves various purposes: ...

So should I commit the changes made by npm back and forth when switching work machines or when somebody else does npm install? This would be a nightmare.

Currently I just discard any changes to package-lock.json made by npm, and it's been working fine. So I might as well add it to .gitignore...

Am I doing it wrong? Should I use npm ci instead? I wouldn't call my computer a "CI", it's just a development machine, why should I use it there?

Basically I have the same question as this gentleman:

https://github.com/npm/npm/issues/18103#issuecomment-370401935

(Sadly I can't add a comment on that issue or create a new issue at all, the npm repo has issues disabled)

1
node.jsnpmpackage-lock.json
Possible duplicate of Do I commit the package-lock.json file created by npm 5? – kaliatech
It's complicated. Officially package-lock.json is supposed to be committed, but a lot of people do not. To understand, you also need to read up on npm shrinkwrap and npm ci. See these related questions: stackoverflow.com/questions/52499617/…, stackoverflow.com/questions/44206782/…. – kaliatech

1 Answers

-3
votes

Yes you want to commit your package-lock.json file to source control. The reasoning behind this is to ensure that all of the same versions of each package are downloaded and installed for each user that pulls down the code. There are some other reasons to include the file such as tracking changes to your package tree for auditing.