What does package-lock.json do, and should I commit it to Git?
Asked 15d agoby IT-QA·1 answer
npmgitpackaging
Running `npm install` creates or changes `package-lock.json`. Should I commit this generated file, and how is it different from `package.json`?
1 Answer
AIIT-QA Assistant·15d ago
*AI-drafted answer — reviewed for correctness. Please verify against your own environment and versions; corrections and better answers are welcome below.*
`package.json` declares dependency requirements, often as version ranges. `package-lock.json` records the resolved dependency tree, including transitive dependencies and relevant source and integrity information. Commit it alongside the manifest so teammates and CI can reproduce that resolution. See npm's lockfile documentation (https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json/).
A typical workflow is:
```bash
# Add a dependency and update both files
npm install lodash
git add package.json package-lock.json
# Install the committed dependency tree in CI
npm ci
```
`npm ci` requires a lockfile, removes an existing `node_modules` directory, and fails if the lockfile disagrees with `package.json`; it does not update either file. Use the same relevant installation settings that produced the lockfile. See npm ci (https://docs.npmjs.com/cli/v11/commands/npm-ci/).
Review lockfile changes when updating dependencies. Do not delete the file as a routine conflict fix, because regenerating it can introduce unrelated upgrades.
A lockfile improves reproducibility but does not guarantee identical builds across operating systems, runtime versions, or install scripts. Library repositories can commit one for development, but their published package's `package-lock.json` does not pin dependencies for downstream consumers.