npm package-lock.json

[Thomas De Schampheleire]

Hello,

I found the following output during a recent install:


"npm notice created a lockfile as package-lock.json. You should commit
this file."


The created file is kallithea/front-end/package-lock.json and is a
complete description of the npm packages installed with locked
versions.

Some background reading:
https://medium.com/coinmonks/everything-you-wanted-to-know-about-package-lock-json-b81911aa8ab8

The recommendation is thus to commit this file to the repository, but
I assume it also means we should keep it up-to-date frequently for
bugfixes.

Anyone have more experience with this?

Thanks,
Thomas