I had originally been for package.lock, but after reading right through the issue I now agree with your excellent suggestion of package.lock.json. Rather than

I had originally been for package.lock, but after reading right through the issue I now agree with your excellent suggestion of package.lock.json. Rather than just talk here, I've posted against the issue suggesting this approach basically asking for up/down votes. https://github.com/npm/npm/pull/16441#issuecomment-304458746 https://github.com/npm/npm/pull/16441#issuecomment-304458746