We should probably exclude the package-lock.json from linting rules, because it is auto generated.

I have some concerns regarding the new comment, as these files don't really belong to aphlict, but are npm npm artifcats. If node-ws is installed via e.g. the system package manager (which is probably the better idea anyway), these files/folders won't be created.

In D25004#121, @Ekubischta wrote:

Will this cause a conflict? - I feel like it will..?

The problem with package-lock.json is, that it either generates noise in the working copy (it just changes its content a lot of times during normal operation). And it needs an update every time a dependency (even indirect) got an security related update because production installs will otherwise not pull the updated dependency in.

AFAIK package-lock.json is only used by npm itself, when deciding on which version to download. If no package-lock.json exists the version are taken to match package.json.

Emails have a bunch of X-Phabricator-* headers, for configuring rules in mail clients.

• We may want to allow installs to keep it as Phabricator for compatibility

Also for completeness the diff between the pre-deprecation README (from rP95662ae8f1) and the proposed version:

Spotted a leftover Phabricator

Just my 2cts: