Question on "package-lock.json"

[FlorentDancy]

Hello,

Shouldn't this file be added to .gitignore?
I can take care of the pull request if needed, just like #3203!

Cheers,
Flo

[ChrisHuie]

Hi @FlorentDancy

So we do want to make sure and have this file included in our repo because it allows for fine-grained dependency adjustments. Node kinda handles dependencies in a unique way by duplicating the entire dependency tree for each package even if they rely on the same package. So we update that file with things like dependeny based vulnerability warnings and other dependency of a dependency things.

[FlorentDancy]

Thanks for the explanation @ChrisHuie!
I was asking because the file was updated when I ran npm install on my machine, and I didn't want to include it in my commit, so I figured I wasn't the first to experience this.

Adding package_lock.json to .gitignore wouldn't remove the file from the repo though, it would just prevent folks running npm install to have to deal with diffs on this specific file while they actually wanted to work on something else.
Plus, even when a file is in the .gitignore, edits can be performed thanks to commands like git add --force my/ignore/file.foo, which could be run by the person who is actually working on this file.

What do you think?

[ChrisHuie]

@FlorentDancy So in the prebid.js repo we actually recommend using npm ci instead of install. The difference is install builds the package-lock file off of the package.json. However, using npm ci actually builds off of that package-lock file that is uploaded. We used to have instructions with install but earlier this year moved to the npm-ci command.

[FlorentDancy]

Oh OK, I didn't know about this command and what it does exactly, thanks Chris!
It makes sense then because when running npm ci your package-lock.json isn't updated, so nothing changes from a git standpoint.

For info I had run npm install because I followed the instructions in the README.md: https://github.com/prebid/prebid.github.io/blob/master/README.md#prerequisites
Should we make more explicit there that one should use npm ci instead?

[ChrisHuie]

@FlorentDancy if you think npm ci vs npm install could be more clear would appreciate a pr :) I think the only place that exists is in the readme file so there could probably be a doc update somewhere that would help.

[FlorentDancy]

@ChrisHuie I just created the PR, is that OK for you? :)