The package ecosystem.
WHAT TO COMMIT
The manifest declaring dependencies The lock file recording exact resolved versions
WHY THE LOCK FILE
It guarantees identical installations everywhere.
WHAT NOT TO COMMIT
The installed modules directory.
WHAT TO USE IN DEPLOYMENT
The command installing exactly what the lock file specifies.
WHY
It is faster and reproducible.
WHAT TO SEPARATE
Runtime dependencies from development dependencies.
WHY
Development dependencies should not be installed in production.
WHAT TO BE CAREFUL WITH
The number of transitive dependencies Packages with very few users Packages running scripts on installation Packages with names similar to popular ones
WHAT TO RUN
A vulnerability check, automatically and regularly.
WHAT TO REVIEW
Whether each dependency is still needed.
WHAT TO ASK BEFORE ADDING ONE
Does the standard library already do this?
WHY
A surprising proportion of small packages replace a few lines.
WHAT TO PIN
The runtime version, in the manifest.
