Understanding the package-lock.json

Historically, the package.json file was the only file that we needed to manage the dependencies of our project. But this file has a problem: it doesn’t contain the exact version of each sub-dependency that we have installed in our project and was also quite slow to install the dependencies.

Not having the exact version of each sub-dependency can be a problem because if we install the same dependency in two different environments, we can end up with different versions of the same dependency. The lack of immutability in our dependencies can lead to unexpected errors and bugs that are quite complicated to debug.

Also, by default, when we install a dependency the version that is recorded in package.json includes a caret ^ symbol, such as "express": "^4.18.3". This symbol means that we can install any version of the dependency that is compatible with the version that is recorded in package.json.

The package-lock.json...