Lock files

[jneuendorf]

Question

@chrisblossom Why did you decide not to use lock files (neither NPM nor Yarn) in this project? From what I've read those are a step forward (regarding dependency management). If there is a good reason (I'm sure you at least had a good reason) I'd really like to learn what it is! 🙂

[chrisblossom]

Both package-lock.json and yarn.lock should be used for applications (but only one).

In my opinion, libraries should not use lock files because the end user can (and will) end up with different dependencies since both npm and yarn ignore dependency lock files. So your library can seemingly pass tests, but be broken for end users.