I suppose there's no hard answer here, but would like to know how others deal with diff being messed up when committing package-lock.json into their node repo.
So far most opinions seem to favor committing package-lock.json - ensure the exact same versions of dependency are installed anywhere and everywhere (See Do I commit the package-lock.json file created by npm 5?
). But it has messed up diff tool each time I upgrade npm dependencies. The code frequency visualization tool on Github is basically useless since I started to commit package-lock.json.
As an example, the two inflated spikes from the graph below were the result of the changes in package-lock.json triggered by mere npm update.
Is there any way to mitigate this? or should I remain indifferent to this downside?