npm 5.6.0中package-lock.json是否无用？是否应提交至版本库？

Hey there! As a fellow Node.js developer who’s been through this exact confusion, let’s break this down clearly—totally get why you’re scratching your head when docs feel outdated and you’re seeing conflicting takes online.

First, What Does package-lock.json Actually Do Now? #

Don’t let the older Stack Overflow questions fool you—this file is far from useless in npm 5.6.0. Its core, non-negotiable jobs are:

• Lock exact dependency versions: Even if your package.json uses range specifiers like ^1.2.3 or ~1.2.3, package-lock.json records the precise version (including all nested sub-dependencies) that was installed on your machine. This ensures every teammate, CI pipeline, or deployment server installs the exact same set of dependencies—no more "it works on my machine" bugs from silent version mismatches.
• Speed up installs: npm uses the cached dependency tree in package-lock.json to skip recalculating dependency resolutions, making npm install run much faster, especially on large projects with dozens of dependencies.

Should You Commit package-lock.json? #

Yes—this is a critical best practice, even with the risk of merge conflicts. Here’s why:

• Without it, every time someone runs npm install, they might get slightly different versions of dependencies, which can introduce hidden bugs or breakages that are impossible to trace back easily.
• Merge conflicts are annoying, but they’re trivial to fix:
  1. Pull the latest version of your branch with git pull.
  2. Run npm install—npm will automatically update package-lock.json to resolve the conflict and reflect the correct combined dependency tree.
  3. Commit the updated package-lock.json along with your other changes.

Addressing Your "Almost Useless" Concern #

It’s totally understandable to feel this way if you haven’t run into version-related issues yet. But here’s the reality: when a dependency’s minor or patch update introduces a breaking change (yes, this happens even when semver says it shouldn’t), package-lock.json is your safety net. It lets you roll back to a known working set of dependencies instantly, instead of hunting down which random version broke your project.

The confusion often comes from older npm versions (pre-5.1.0) where package-lock.json behaved unpredictably (e.g., it would get overwritten unexpectedly during updates). But npm 5.6.0 fixed most of those quirks—its behavior is now stable and focused on reliable version locking.

Quick Tips for New Node.js Developers #

• Never add package-lock.json to your .gitignore.
• Avoid manually editing package-lock.json—let npm handle updates when you run npm install, npm update, or install new packages.
• If you’re ever unsure, run npm help package-lock to get the most up-to-date (if still imperfect) official info directly from your terminal.

内容的提问来源于stack exchange，提问作者flagg19