Lock File

Lock files are boring but essential. They prevent a whole category of bugs caused by "but it works on my machine."

Lock File Names

Why Lock Files Exist

Without a lock file:

package.json says: "react": "^19.0.0"

Developer A installs → gets React 19.0.0
Developer B installs next week → gets React 19.1.0
Production deploys → gets React 19.2.0

Same project, three different versions. Bugs happen.

With a lock file, everyone gets the exact same version.

Lock File Rules

Always Do

• Commit to version control — Everyone needs the same lock file
• Use one package manager — Don't mix npm and yarn lock files
• Let the tool manage it — Don't edit lock files manually

Never Do

• Add to .gitignore — Lock files must be committed
• Delete to fix problems — Usually makes things worse
• Edit manually — Let the package manager handle it

When Lock Files Cause Issues

Occasionally, lock files cause merge conflicts. The fix is usually:

1. Accept one version of the lock file
2. Delete node_modules
3. Run npm install (or your package manager's install command)
4. Commit the regenerated lock file