package-lock.json ? Necessary or Noise?

The purpose of the `package-lock.json` file is to "lock" the list of dependencies for a Node.js project beyond simply _listing_ the dependencies in a `package.json` file.

Here is an example of a `package-lock.json` being added to a project:

GitHub (_obviously_) does not _show_ the full 10k lines of JSON because it's a _massive_ file.

When we attempt to expand on this list we see an _ocean_ of dependencies and versions:
What does this information tell us?
It tells us the _precise_ versions of all the dependencies that are being used in the project at this point in its' history. That is a _good_ thing right...?
Well, on the _surface_, yes, it _is_ a good thing to have a _precise_ control of the dependencies, that's incontestable.

The question is: will having a `package-lock.json` file _save_ you from a "bad" dependency update? or is the file simply creating _clutter_ and _noise_ in your project?

As much as I _hate_ the _noise_ of a `package-lock.json` file having _hundreds_ of lines updated each time a dependency is updated, on balance I feel it's a _necessary_ evil for _some_ projects that don't have _complete_ end-to-end testing. When an app does not have good testing and continuous integration, `package-lock.json` can be a good "fallback".

There is no _substitute_ for having _full_ test coverage when upgrading versions of a dependency.