npm package-lock Discipline
Why commit package-lock.json / pnpm-lock.yaml, and what goes wrong if developers run floating installs?
Answers use simple, clear English.
Quick interview answer
Lockfiles pin exact transitive versions for reproducible installs across CI and prod. Without them, 'works on my machine' drifts appear and supply-chain changes sneak in unexpectedly. Use npm ci in CI, not npm install, to respect the lockfile strictly.
Detailed answer
Lockfiles pin exact transitive versions for reproducible installs across CI and prod. Without them, 'works on my machine' drifts appear and supply-chain changes sneak in unexpectedly. Use npm ci in CI, not npm install, to respect the lockfile strictly.
Real example & use case
CI uses npm ci so Friday's build matches the lockfile reviewed in the PR.
Pros & cons
Pros: reproducibility. Cons: merge conflicts in lockfiles — resolve carefully, don't delete casually.