NPM is rather infamous for not exactly respecting the lockfile, however.