Do I commit the package-lock.json file created by npm 5?

Yes, you should generally commit the package-lock.json file created by npm v5 (and above) to your version control repository. Committing the lock file ensures consistent, reproducible installs across different environments and build servers. Below is a detailed explanation and common considerations:

1. What Does package-lock.json Do?

• Tracks Exact Versions: It pins the exact versions of all installed dependencies (and their sub-dependencies).
• Improves Install Consistency: Ensures that every environment—be it local development, CI/CD pipelines, or production—uses the same dependency tree.
• Speeds Up Installs: npm can optimize installations by referencing this lock file, often improving performance.

2. Why Commit It?

1. Reproducible Builds

   • Without a committed lock file, your npm install could pull newer patch or minor versions of dependencies—potentially introducing unexpected bugs or behavior changes.
   • With a lock file, each install yields exactly the same dependency versions.

2. Collaboration

   • Team members working on the same project will have an identical dependency graph. This consistency reduces the “it works on my machine” problem.

3. Best Practice

   • The npm documentation recommends committing package-lock.json (and Yarn recommends committing yarn.lock for similar reasons).

3. Potential Conflicts and Merges

• Merge Conflicts: When multiple developers update dependencies, you can get merge conflicts in the lock file.
• Resolution: Typically, you’ll merge or regenerate the lock file after resolving conflicts, then re-run npm install to ensure it’s still valid.

4. Exceptions or Edge Cases

• Library vs. Application:

  • For applications, always commit the lock file. This ensures production or staging servers install exactly the same versions.
  • For shared libraries, some developers prefer not to commit lock files, arguing that library consumers ultimately control dependency versions. However, the npm recommendation is still to commit the lock file to ensure tests and local development are consistent for library contributors.

• Continuous Delivery: In some workflows, teams prefer certain automation steps (like building Docker images) to ignore lock files or re-generate them. This is not a common setup, but it can exist in highly specialized pipelines.

Recommended Resource

• Grokking JavaScript Fundamentals

5. Summary

In the vast majority of cases, commit your package-lock.json to version control. Doing so reduces unexpected bugs, speeds up installs, and fosters consistent environments for all developers and deployment targets.