DEV Community

Discussion on: But what the hell is package-lock.json?

Collapse
 
robbyp profile image
robby • Edited

Hello Kat 👋

I found this article and this comment after so much searching, and both have been a great help to my understanding of npm. Thanks everyone!

There are still somethings I am not clear on.

1) Does npm install with a package-lock present, with semver satisfied between it (the lockfile; having exact versions) and the package.json (with semver), cause the package-lock file to be updated? (maybe there's a new satisfiable version out there in the registry) -- OR does it just go about installing the modules since package.json and package-lock are in sync?

If it does update even when satisfied, does npm install some-new-package also cause this update?

2) Is it currently acceptable to manually update package.json?

3) You mentioned multiple npm install behaviors, so which are you referring to here:

the behavior for npm install was actually what people wanted, in practice (when they actually ran into the behavior)

Thanks again! Any help is greatly appreciated!

Cheers 🤙
Robby