title: What is the point of putting npm's "package-lock.json" under version control?
body: <p>What is the point of putting npm's <code>package-lock.json</code> under version control? In my experience having this file source controlled has caused more trouble and confusion than efficiency gains.</p>
  
  <p>Having <code>package-lock.json</code> under source control makes for a <strong>major headache</strong> every time a developer who added/removed/modified any node modules needs to <strong>resolve conflicts</strong> between branches. Especially working on a complex/large apps where the package-lock.json can be tens of thousands of lines long. Even just blowing away node_modules and running a fresh <code>npm install</code> can generate drastic changes in the package-lock.</p>
  
  <p>There are several other SO questions about the package-lock:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/44206782/do-i-commit-the-package-lock-json-file-created-by-npm-5">Do I commit the package-lock.json file created by npm</a></li>
  <li><a href="https://stackoverflow.com/questions/44297803/package-lock-json-role">Npm - package-lock.json role</a></li>
  <li><a href="https://stackoverflow.com/questions/45022048/why-does-npm-install-rewrite-package-lock-json">Why does npm install rewrite package-lock.json?</a></li>
  </ul>
  
  <p>And a GitHub issue with a ton of conversation about package-lock:</p>
  
  <ul>
  <li><a href="https://github.com/npm/npm/issues/16866" rel="noreferrer">package-lock.json file not updated after package.json file is changed</a></li>
  </ul>
  
  <p>Which makes me think there is still widespread uncertainty that needs cleared up.</p>
  
  <p>According to the docs </p>
  
  <blockquote>
    <p><code>package-lock.json</code> is automatically generated for any operations where npm modifies either the node_modules tree, or package.json. </p>
  </blockquote>
  
  <p>So <strong>why would you ever want to put an automatically generated file under source control?</strong></p>
  
  <p>The above GitHub issue details how some people, in response to confusion with the package-lock.json, change their <code>npm install</code> script to <code>rm -f package-lock.json &amp;&amp; npm install</code>, which also does not feel correct.</p>
  
  <p>It seems like <code>package-lock.json</code> is striving to be the source of truth for the exact version of node module dependencies, but isn't that exactly what the package.json does? When does the excruciating pain of resolving merge conflicts in this file start to pay off?</p>