package lock file usefulness?

[j-d-carmichael]

As the lock file will be generated by npm on npm i.. and the gh-alert-bot can only increment within the permitted range indicated in a packages package.json file.. the question is, what is the point in these templates having a package-lock.json file at all?

[j-d-carmichael]

Also.. the lock file here in the tpl and a lock file in a project cannot be merged by the core as this will most likely collide with the changes npm makes anyway.. seems like redundant spam here.

[p-mcgowan]

I don't think it's super useful - it's only created one time on fresh gen, and ignored otherwise. The only issue (and the whole purpose of the lockfile) is that if we removed it, and someone did a fresh gen of a project and 1 package with a particular bump to the minor causes some build errors or something then that could mean it looks broken.

Having the lockfile is just something like a disclaimer saying "these are the last versions which worked on my machine", but typically it diverges from the template version quite quickly. That being said, when we automate template testing (still on my list) the lockfile will be pretty important for CI

[j-d-carmichael]

Yea when that feature comes in there is some use for it