> It is highly recommended you commit the generated package lock to source control Fixed the Javascript way, layers of workarounds. And if you indeed need to

> It is highly recommended you commit the generated package lock to source control Fixed the Javascript way, layers of workarounds. And if you indeed need to update a dependency, you need to regenerate the lock. But the main difference is that when that happens, the onus to verify all packages transitive unpinned dependencies still result in a working combination (of which there is no guarantee) is on the receiving developer, not on the package maintainer.