title: What is the difference between npm-shrinkwrap.json and package-lock.json?
body: <p>With the <a href="http://blog.npmjs.org/post/161081169345/v500" rel="noreferrer">release of npm@5</a>, it will now write a <code>package-lock.json</code> unless a <code>npm-shrinkwrap.json</code> already exists.</p>
  
  <p>I installed npm@5 globally via:</p>
  
  <pre><code>npm install npm@5 -g
  </code></pre>
  
  <p>And now, if a <code>npm-shrinkwrap.json</code> is found during:</p>
  
  <pre><code>npm install
  </code></pre>
  
  <p>a warning will be printed:</p>
  
  <pre><code>npm WARN read-shrinkwrap This version of npm
  is compatible with lockfileVersion@1,
  but npm-shrinkwrap.json was generated for lockfileVersion@0.
  I'll try to do my best with it!
  </code></pre>
  
  <p>So my take-away is that I should replace the shrinkwrap with the <code>package-lock.json</code>.</p>
  
  <p>Yet why is there a new format for it? What can the <code>package-lock.json</code> do that the <code>npm-shrinkwrap.json</code> cannot?</p>