Add npm package-lock

[thornjad]

This adds package-lock.json which will help prevent future dependency problems. From the npm documentation:

This file describes an exact, and more importantly reproducible node_modules tree. Once it's present, any future installation will base its work off this file, instead of recalculating dependency versions off package.json.

[indexzero]

Should we be publishing package-lock.json files? If http-server is used as a dependency instead of a global CLI tool wouldn't this complicate the install tree?

[thornjad]

If published, it would definitely end up complicating the install tree of anything using it as a dependency. However, part of the beauty of package-lock.json is that it can't be published. When publishing, npm will simply ignore it. It's designed for use in the source code only, i.e. here on GitHub.

[thornjad]

Using a package-lock.json ensures that everyone who works with this source code will be using the exact same versions of every dependency. Its use is strongly encouraged by npm.

[BigBlueHat]

@thornjad we should try and get package-lock.json updated and committed before the next release. It is, as you've noted, the new normal. 😃

[thornjad]

Perfect! I just updated this PR so the package-lock.json is up to date with master.

[BigBlueHat]

Thanks @thornjad!