title: Is there a way to confirm a package-lock.json actually resolves all dependencies in a package.json?
body: <p>We want to add an automated check to our CI server that would prevent code from getting committed that updates a dependency in <code>package.json</code> but does not update the resolved dependency in <code>package-lock.json</code>.</p>
  
  <p>This could happen if, for example, someone updated a dependency in <code>package.json</code> manually but ran <code>npm install</code> instead of <code>npm update</code> (<code>npm install</code> favors <code>package-lock.json</code>, if present). Or it could happen even if someone runs the correct <code>npm</code> command when updating a dependency but then forgets to commit the resulting changes to <code>package-lock.json</code>. We try to watch for these things in code review, but an automated check would definitely be better. Is there any <code>npm</code> command that does this?</p>
  
  <p>Here's an example to illustrate.</p>
  
  <p><strong>Before</strong>:</p>
  
  <pre><code>// package.json
  {
      "lodash": "~3.1.0"
  }
  
  // package-lock.json
  {
      "dependencies": {
         "lodash": {
             "version": "3.1.3"
         }
      }
  }
  </code></pre>
  
  <p>Someone updates <code>package.json</code> but forgets to commit the change to <code>package-lock.json</code>.</p>
  
  <p><strong>After:</strong></p>
  
  <pre><code>// package.json
  {
      "lodash": "~3.2.0"
  }
  
  // package-lock.json (not changed)
  {
      "dependencies": {
         "lodash": {
             "version": "3.1.3"
         }
      }
  }
  </code></pre>
  
  <p>Now <code>package-lock.json</code> no longer reflects a valid set of dependency resolutions for the <code>package.json</code> file.</p>