package-lock.json

Definition

An automatically generated file that describes the exact dependency tree that was installed, ensuring that subsequent installs reproduce an identical node_modules tree.

Explain Like I'm New

If package.json is the recipe, package-lock.json is the exact grocery store receipt. It says: 'You installed Express version 4.18.2 on Tuesday, and Express requires Accepts version 1.3.8'. It locks down the exact sub-versions of every single library so that if another developer runs `npm install`, they get the exact same code, avoiding 'It works on my machine' bugs.

Real World Example

You deploy your app on Friday. It works. Over the weekend, a deeply nested library (`is-regex`) pushes a broken update. Without a package-lock, your server might download the broken update on Monday and crash. The lockfile prevents this.

Common Use Cases

•Consistent environments
•Deterministic deployments
•Security auditing

Interactive Example

Console output will appear here...

Interview Questions

basic

Should you commit `package-lock.json` to Git/GitHub?

intermediate

What is the difference between `npm install` and `npm ci`?

Flash Cards

Question

Should you commit it?

Click to reveal answer

Answer

YES! Always commit the package-lock.json. This is the only way your teammates and your production server will know exactly which versions of libraries to install.

Question

npm install vs npm ci?

Click to reveal answer

Answer

`npm install` might update the lockfile if it finds a slightly newer minor version allowed by your package.json. `npm ci` (Clean Install) is used on production servers; it strictly reads the lockfile, deletes the existing `node_modules`, and installs the exact locked versions without ever modifying the lockfile.