什么是package-lock.json？

Question

Is there any kind-teacher can answer my question above?

FYI I'm using WebStorm and making with node.js I installed npm module like nconf and package-lock.json has made. I expected package.json would've been made.

Thank you.

Answer 1

Describe the dependency tree in a given moment, so with this description all the dependencies can be created again exactly the same way it was, this ensures the expected behavior from the dependencies.

In the npm documentation you can read:

package-lock.json is automatically generated for any operations where npm modifies either the node_modules tree, or package.json. It describes the exact tree that was generated, such that subsequent installs are able to generate identical trees, regardless of intermediate dependency updates.

This file is intended to be committed into source repositories, and serves various purposes:

Describe a single representation of a dependency tree such that teammates, deployments, and continuous integration are guaranteed to install exactly the same dependencies.

Provide a facility for users to "time-travel" to previous states of node_modules without having to commit the directory itself.

To facilitate greater visibility of tree changes through readable source control diffs.

And optimize the installation process by allowing npm to skip repeated metadata resolutions for previously-installed packages.

Answer 2

Package-lock.json文件包含package.json文件中列出的依赖项以及应安装的依赖项的特定版本