title: Is it worth the trouble to commit package-lock.json?
body: <p>I have a NodeJS project published on GitHub that uses a few NPM modules, as specified in my <code>package.json</code>. I have my <code>package-lock.json</code> committed into the repo.</p>
  
  <p>Recently I got notices on my repository about a recently-discovered security vulnerability in one of my dependencies. Upon further inspection, it wasn't one of my direct dependencies that had a vulnerability but rather a module that one of my dependencies is dependent on. Because all the modules show up in my <code>package-lock.json</code>, the notice comes up telling me to update that dependency to the latest version.</p>
  
  <pre><code>- myproject
    - someDependency
    - anotherDependency
      - aSubDependency
      - anotherOne &lt;--- this one has a security issue
  </code></pre>
  
  <p>So now I have to question: Is it worth committing a <code>package-lock.json</code>? I wouldn't have any security vulnerabilities in my project if I didn't have a <code>package-lock.json</code>. Now, I am forced to update my project and republish simply to update the <code>package-lock.json</code>. If that file wasn't there at all, the problem would fix itself because anyone who does an <code>install</code> or <code>update</code> of my project using ONLY the <code>package.json</code> would automatically get the updated dependency from up the stream.</p>
  
  <p>Think about it like this. Bob creates <code>moduleA</code>. Then someone else creates <code>moduleB</code> that is dependent on <code>moduleA</code>. Then 1000 developers out in the world create various projects that directly are dependent on <code>moduleB</code>. If Bob discovers a security vulnerability in <code>moduleA</code>, now 1000 people have to make an update to their 1000 projects just to fix this all because they were committing their <code>package-lock.json</code>.</p>
  
  <p>So it is worth it? Do the advantages of <code>package-lock.json</code> outweigh the drawbacks in this topic?</p>