title: Do I need both package-lock.json and package.json?
body: <p>After updating my NPM to the latest version (from 3.X to 5.2.0) and running <code>npm install</code> on an existing project, I get an auto-created <code>package-lock.json</code> file.</p>
  
  <p>I can tell <code>package-lock.json</code> gives me an exact dependency tree as opposed to <code>package.json</code>.</p>
  
  <p>From that info alone, it seems like <code>package.json</code> is redundant and not needed anymore.</p>
  
  <p>Are both of them necessary for NPM to work?
  <br>
  Is it safe or possible to use only the <code>package-lock.json</code> file?</p>
  
  <p>The docs on package-lock.json (<a href="https://docs.npmjs.com/files/package-lock.json" rel="noreferrer">doc1</a>, <a href="https://docs.npmjs.com/files/package-locks" rel="noreferrer">doc2</a>) doesn't mention anything about that.</p>
  
  <p><strong>Edit</strong>:</p>
  
  <p>After some more thinking about it, I came to the conclusion that if someone wants to use your project with an older version of NPM (before 5.x) it would still install all of the dependencies, but with less accurate versions (patch versions)</p>