Package.json and Package-lock.json in Node.js

This tutorial explains the purpose, differences, and best practices for package.json and package-lock.json in Node.js projects.

1. By running the command: npm init
2. When we install any module or library using npm, the package.json file is created automatically.
Note: We don't create package-lock.json manually because it is automatically created and managed by npm.

npm init is a command-line instruction used to create a package.json file for a Node.js package.
The "npm init" command will initialize a project and create the package.json file.
A few questions are asked by npm each time the init command is run.

When you create a Node.js project, running npm init should be the first step.

package.json: This file is primarily used for managing and documenting metadata about the project, including its name, version, author, dependencies, scripts, and other configuration details. It acts as a manifest for the project.
package-lock.json: This file is generated and updated automatically by npm when installing or updating packages. It locks the exact versions of dependencies installed, ensuring reproducibility and consistent installations across environments.

package.json: Contains the list of dependencies required for the project, along with their desired version ranges specified using semantic versioning or specific version numbers.
package-lock.json: Includes the specific resolved versions of all dependencies, their sub-dependencies, and their exact installation locations. Acts as a snapshot of the dependency tree.

package.json: Tracked in Git and serves as a shared configuration file.
package-lock.json: Also tracked in Git to ensure consistent dependency installations across environments.

package.json: Developers manually edit this file to add/remove dependencies, modify scripts, update version ranges, or make other changes.
package-lock.json: Generally not meant to be manually edited. Manual changes can cause inconsistencies or conflicts.

The package.json file focuses on project metadata and specifying desired dependency versions, while package-lock.json ensures deterministic installations by locking exact versions of dependencies. Both files are essential but serve different purposes.

const pkg = require('./package.json');
console.log("Project Name:", pkg.name);
console.log("Version:", pkg.version);
console.log("Author:", pkg.author);
console.log("\nDependencies:", Object.keys(pkg.dependencies).join(', '));