Express: Why package-lock is not in source control?

[buccfer]

https://github.com/expressjs/express/blob/10c7756764fbe969b307b15a72fd074479c00f8d/.gitignore#L18

According to NPM docs:

This file is intended to be committed into source repositories.

Which doesn't mean that it should be published to npm:

One key detail about package-lock.json is that it cannot be published.

Is there any reason for lock file to be ignored I'm missing?

Thanks, and keep up with the great work.

[dougwilson]

Since npm ignores a package-lock.json file that is in a package, adding one here will have no effect on consumers and will make the CI no longer represent the dependencies a consumer would get by running npm install express.

[buccfer]

Thanks @dougwilson for the great explanation :+1: