package.json vs package-lock.json

package[-lock].json.md

package.json

"files" vs .npmignore

files - whitelisting all files that should be included in a npm release

.npmignore - blacklisting all files that should be included in a npm release

package-lock.json

Q & A

1. Why package-lock.json?

   Lock dependency tree for repeated installations.

2. What's the source of truth when it comes installing node_modules? package-lock.json or package.json or package.json + package-lock.json?

   package.json + package-lock.json

3. What's the relationship between package.json and package-lock.json?

   package.json overrules package-lock.json when ^/~ was used in package.json.

4. npm update [package] or npm install [package]?

5. npm ci

6. Which to choose when managing dependency versions in package.json? ^ or ~ or exact version? What's the context? (library vs plugin vs app)

Related:

• npm/npm#16866
• https://github.com/renovatebot/renovate