Update guidance about package-lock.json

[philippjfr]

Closes #739

[codecov]

Codecov Report

Merging #1220 into master will not change coverage by %.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #1220   +/-   ##
=======================================
  Coverage   87.41%   87.41%           
=======================================
  Files         106      106           
  Lines       12619    12619           
=======================================
  Hits        11031    11031           
  Misses       1588     1588           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8d02f5a...2f6d3a4. Read the comment docs.

[mattpap]

I would suggest using a full version string like 0.9.4-dev.1 or 0.9.4-rc.1 and publishing with an appropriate tag, i.e. npm publish --access=public --tag=dev (or --tag=rc respectively). For production release you can skip --tag altogether or use --tag=latest (that's the default).

[mattpap]

Also version should be kept in package.json, then npm install will update package-lock.json.

[philippjfr]

So this was a build number generated using npm version build because I messed up the initial release of 0.9.4 and did npm unpublish, so I wouldn't ordinarily do this. I also realized too late that you can't republish after unpublishing, which means that the currently released Python packages won't be able to load the 0.9.4 release from the CDN :(

Will have to tag a 0.9.5 soon to fix it.

[mattpap]

(...) can't republish after unpublishing (...)

This used to be possible on npm, but it's so unsafe that it was removed not that long ago.

[philippjfr]

Yeah, it's fair enough, although I wish it gave you a 5 minute window or something or until the first person downloaded it.

[philippjfr]

Merging for now, will reset the version on the next release.