package-lock.json is npm's version of yarn.lock

We may not really need Yarn anymore. The way it worked its magic was when you ran npm install for the first time and the dependencies in package.json got hydrated to the node_modules folder, a yarn.lock file would get created denoting what specific version, down to the patch, was pulled and what specific server it came from. Of course, both of these things are kind of wishy-washy and, in being subject to change, both of these things can break your app when you get different stuff in a second pass at npm install. If the yarn.lock files exists however, it will be used as guideline to prevent different versions and different servers from being used. In modern times you can do all this without Yarn by getting npm to make a package-lock.json file that does the same trick.