easyPhone Screen

What is the purpose of `package-lock.json`?

Q: What is the purpose of `package-lock.json`?

**TL;DR.** package-lock.json records the **exact resolved version** (and integrity hash) of every package in the dependency tree, not just the ranges in package.json . It makes installs **deterministic and reproducible** across machines and CI, and verifies integrity. Always commit it. package.json express: ^4.19.0 (range) resolves package-lock.json</

51 views

Understand the problem

This question tests knowledge of dependency management specifics, crucial for reproducible builds.

npmdependenciespackage-lock.jsonversioning

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Why two installs can differ without it

# package.json says: "lodash": "^4.17.0"
# Without a lockfile, these can resolve to different patches:
#   Monday  → lodash 4.17.20
#   Friday  → lodash 4.17.21
# With package-lock.json committed, both get the SAME version.

npm ci      # CI: install exactly the locked tree, fail if drifted

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

What is the difference between unit, integration, and end-to-end tests for a Node.js API?

How do you handle environment variables in Node.js?