NPM has, starting with version 0.5.1, an absolutely lovely feature where it simply ignores the package-lock.json file altogether. Or to be more precise, "npm install" regenerates package-lock.json based on package.json. What's the point of "npm upgrade" then? Eh.

I hate this reality.

You can use `npm ci` for "don't update the lockfile, fail if an exact lockfile match can't be collected"