- [Instructor] Whenever you run NPM install
on a new project, this weird file called package-lock.json
appears in your root directory.
What is this file, and its purpose?
Well, first I wanted to explain some symantec versioning,
which we went through on the last video,
so you have a good base to understand this file.
In most cases, developers creating packages,
and publishing to NPM, will follow the major, minor,
and patches releases we went through on the last video.
So, in theory, any version within 1.xx
shouldn't have breaking chains to your application.
And, in this huge ecosystem of packages,
in most cases, dependencies rely on others,
and so on, so forth.
So, you can imagine how quickly
this entire tree of dependencies
could break if there isn't any order,
and people following semantic versioning.
So, going back to our example used in the last video,
we just got this project from another developer,
without a package-lock.json,
and we install the dependencies,
start the project, but it doesn't work.
We look at the package.json file, and we see
express version with a caret, with 4.15.4,
and we check, and now it is at 4.25.3.
In this version, however, not major breaks our app.
So, this is where package-lock.json comes to the rescue.
When we do NPM install, the package.json file
is the input, and the package-lock.json is the output.
And, this file will guarantee the same install,
every time we do an NPM install,
wherever we pass this project to.
As long as we commit the package-lock.json file to our repo,
or when you pass this project along to someone,
make sure to include it.
So, let's go back to our scenario.
We got the same project as earlier,
but now with a package-lock.json file included.
And, I run NPM install, well,
it will install 4.15.4, instead of 4.25.3,
unless I delete the package-lock.json file.
So, package-lock.json file is a great way
to control your versioning inside of your projects.