To lock or not to lock

A few years ago, npm introduced the notion of a package-lock.json. The purpose of the file is to provide a manifest that calls out the exact version of every package in your tree, the last time npm install was run. After running npm install, you're going to see a message like this:
npm notice created a lockfile as package-lock.json. You should commit this file.



