Should package-lock.json be include?

[xavArtley]

Shouldn't we remove package-lock.json from the commited files?
@mattpap

[mattpap]

Though it may be tempting due to its usually large size, package-lock.json is a useful tool, which allows to have reproducible environments. Otherwise npm install would result in always installing most recent packages, up to allowed dependency specification. Note however npm install can still change packge-lock.json and upgrade dependencies to some extent. To force npm to only use the lock file, one should use npm ci. This is the command that should be used in CI systems, as it name actually suggests. To fully update dependencies, the approach that works the best for me, is to remove the lock file and run npm install (rm package-lock.json; npm install; git add package-lock.json). I suppose there may be a more idiomatic way that I'm not aware of.

[philippjfr]

We should add some of that to the developer docs.