Handling of package-lock.json files

[koegel]

No description provided.

[edgarmueller]

Moved to eclipsesource/jsonforms-react-seed#10, closing this one.

[edgarmueller]

Re-opening due to recent MUI issues

[koegel]

IMHO this problem could be solved with the suggestion of Mat of committing the package lock json.

[edgarmueller]

It depends, note that the package-lock files are already commited and in use. Right now, the seed does not run if babel/runtime is not included as well, as the released version of MUI the 2.0.1 release is based is on, is missing in the dependencies. I think this is the result of not fixing the version constraints, since we often solve package-lock.json conflicts by just accepting one side of the conflict (because it's very tedious to properly merge those), which means that newer versions than the ones specified in the package.json could end up in the package-lock.json file.

I guess this issue is more about finding out how other libraries or frameworks (not apps) handle the package.json and package-lock.json files.

[eneufeld]

My experience with npm 6 is:
Using npm install the package-lock is updated.
Using npm ci the packages are installed as defined in the lock file and the lock file is not updated.

This SO is very helpful imho: https://stackoverflow.com/questions/44258235/what-is-the-difference-between-npm-shrinkwrap-json-and-package-lock-json

[edgarmueller]

I've added a new section 'Developer documentation' that outlines the guidelines we aggred upon, see https://github.com/eclipsesource/jsonforms/wiki/Developer-documentation