Is there a reason why there is no package-lock.json?

[sunrabbit123]

Question

Typically, developers commit lock files together.

This is not just a practice, but to share detailed versions of information together to prevent bugs caused by simple version differences as much as possible.

Is there a reason?

[samchon]

Because this is not a final produc, but a library.

If I commit the package-lock.json version, I cannot rapidly reflect to the minor/patch level updates of devDependencies.

The alternative solution for such case keeping the package-lock.json is configuring every devDependencies to be targetted to the dependabot, but it makes the maintenance difficult due to spam like pouring dependabot's devDependencies' update PRs.

I'd tried that in the past, but it just didn't work. My notification inbox was polluted with dependabot, which caused major problems for my open source development.