package.json vs. package-lock.json
What is package.json
package.json is a file holds various metadata relevant to the project. It is usually located at the root directory of a Node.js project.
This file will give information to npm for it to identify the project as well as handle the project’s dependencies.
It lists the packages your project depends on, specifies versions of a package to use, so it makes your build reproducible, and therefore easier to share with other developers.
Note package.json is used not only for dependencies management, its purpose is to give detail information about the project such as author, license, repository, scripts, …etc.
What is package-lock.json
package-lock.json is automatically generated for any operations where npm modifies either the node_modules tree, or package.json.
The dependencies we list in package.json is semantic versioning, means it doesn’t have to be a strict certain version, instead we can just specify the acceptable version ranges.
However, if we want every team member set up a development environment with exactly identical dependencies, here is when package-lock.json comes into play.
package-lock.json describes the exact tree that was generated, so that subsequent installs are able to generate identical trees, regardless of intermediate dependency updates.
That’s why this file is intended to be committed into source repositories.
Do we need both ?
We will definitely need package.json , but we may have a project withoutpackage-lock.json.
In short, the package.json is used for more than dependencies management. The package-lock.json is solely used to lock dependencies to a specific version number.
