Package-lock is useful to be able to "timetravel" to see what kind of librarysets were used with older working builds, but to make sure that this package works correctly for the end user the latest available packages should be used for testing.
Also package-lock.json should be marked as binary file so that it will not flood diffs in command line and mess up stats of how many lines were changed etc.
Package-lock is useful to be able to "timetravel" to see what kind of librarysets were used with older working builds, but to make sure that this package works correctly for the end user the latest available packages should be used for testing.
https://github.com/sindresorhus/ama/issues/479#issuecomment-310661514