Remove package-lock.json

[remcohaszing]

Initial checklist

• I read the support docs
• I read the contributing guide
• I agree to follow the code of conduct
• I searched issues and couldn’t find anything (or linked relevant results below)
• If applicable, I’ve added docs and tests

Description of changes

Lockfile version 3 is the successor of version 1. Version 2 is an intermediate format which includes data for both lockfile versions 1 and 3. This means it’s about twice as big and contains twice as many diffs to review.

Most unified packages don’t use lockfiles, but I do think it’s a good idea to use for VSCode plugins. For example new features introduced in unified-language-server shouldn’t go unnoticed for VSCode Remark users.

[wooorm]

For example new features introduced in unified-language-server shouldn’t go unnoticed for VSCode Remark users.

Can you expand on this? I don‘t quite get it.
Shouldn’t we then use a ~ version range for unified-language-server, and release a new version of this package when that package updates?

[wooorm]

@remcohaszing ping!

[remcohaszing]

I have mixed feelings about lockfiles. I like having reproducible builds, but managing lockfiles can be a churn. I have been using lockfiles for my own projects, but have also been thinking of removing them.

I can relate with this comment

Lockfiles for apps, but not for packages.

In case of a VS Code extension, I lean towards saying it’s more of an app than a package. The end user won’t get updates by updating their dependencies or force reinstalling it. They rely on the release cycle of this plugin. If unified-language-server gets a release with new features, remark-language-server gets these features automatically. For vscode-remark another release is needed and it makes sense to document the new features in the release notes, even if they come from upstream.

Regardless of the stance on lockfiles, I do believe package-lock.json v3 is superior over v2 (the npm default), because v2 is just lockfile v1 and v3 combined in one JSON file, duplicating its size.

[wooorm]

I’m in favor of removing it instead of updating.
If we didn’t remove, then updating would be useful.

While lockfiles could provide some useful information in the problem you mention, they are often so verbose that lockfile updates are often ignored if CI works fine, defeating that purpose.