A package-lock.json file is like the Customer Success Manager at your company: They are both present in every project but you are not sure why and what exactly they do. And you are scared of conflicts with them: especially lock file merge conflicts.
In this article, you are going to learn what's inside a lock file, why it helps with the it works on my machine problem and why it can even enhance the security of your project.
⚠️ I use npm for my examples, but the concepts also apply for yarn or other package managers.
How dependencies work
It turns out, your favourite libraries and packages are often not only built with magic, but with other packages we call dependencies. So when installing for example express in your project, you actually install express and with it everything express devs used to build express.
This is why your node-modules folder suddenly has stuff you did never install: Because the dependencies of your dependencies and their dependencies and their dependencies dependencies are all sitting together making your incredible project work as intended.
Why does the lock file improve security?
Imagine that Henry the Hacker has been highly productive and managed to get access to the express npm account. He changed the version 4.18.2 to contain a vulnerability to exploit the projects installing it. (Something like this has happened for example in 2018: on Unsplash
SOCIAL SHARE CARD GENERATOR