package-lock-json vs package-json

package-lock.json: records the exact version of each installed package which allows you to re-install them. Future installs will be able to build an identical dependency tree.

package.json: records the minimum version you app needs. If you update the versions of a particular package, the change is not going to be reflected here.

https://stackoverflow.com/questions/45052520/do-i-need-both-package-lock-json-and-package-json