Add package lock.json to VCS #7533

[tshradheya]

Fixes #7533

Outline of Solution

1. Added package-lock.json to VCS after running npm install
2. Updated doc to specify minimum Node.js version as 8.x

[tshradheya]

Ready for Review

[wkurniawan07]

You need to update this document; mention that after npm install, there will be changes to the package-lock.json file that should be committed.

[wkurniawan07]

Let's rephrase a bit: "...from the project root folder. Additionally, if you are adding/updating the library, commit the changes made automatically to package-lock.json.".

Rationale: only if you're adding/updating the library then you will see the change.

[tshradheya]

Updated by making the following change:

• Additionally, if you are adding/updating the any library, commit the changes made automatically to package-lock.json.

[wkurniawan07]

@tshradheya For some reason my package-lock.json does not match yours. Instead of "bundled": true in about 100 places I have resolved and integrity fields. Can you check if deleting your package-lock.json and running npm install again still results in this copy of package-lock.json you committed?

[tshradheya]

Figured out why such a problem was there.

Figuring out how to solve it

So the fsevents package is meant to be optional on systems other than mac and hence I get the above Warn everytime I run npm install.(Interesting discussion on whether it should be WARN or INFO :P )

The reason why I have "bundled" is probably because of "optional": true in fsevents, which doesnt allow sub modules to be processed. Because mac doesnt consider fsevents as optional, hence you might not have the "optional": true in your package-lock.json (Can confirm?)

This problem has been faced by many people (some even went to the extent of migrating to yarn :P ) and the workaround suggested doesn't feel right cause new developers might be confused.

The only way we can get package-lock.json to VCS is to get rid of the only optional dependecy(is this even possible? 😕 ) which is fsevents, otherwise we can avoid adding the package-lock.json file

[wkurniawan07]

In that case I don't think it's suitable for package-lock.json to be version-controlled. @whipermr5 any further thoughts?

[tshradheya]

Okay so researching about it a bit more, I realised that Node.js actually resolved this bug. Source

However to make sure, it works perfectly fine for Teammates, I am going to try on mac and not mac to see if package-lock.jsom keeps changing due to optional dependencies.
The solution will be to generate the package-lock file on mac system and check if on running npm install on other linux systems if the lock file gets updated or not( according to the bug fix it shouldn't) ( Our min requirement will then change to npm 5.6.0 which is automatically shipped with the latest Node.js 8.9.4)

Will probably need a day more to confirm everything and check if it is possible to commit it.

[wkurniawan07]

Let's close this for now. Can reopen when the Node.js community at large agrees that this package-lock.json should be included, which does not seem to be the case right now.