title: Why does "npm install" rewrite package-lock.json?
body: <p>I just recently upgraded to <em>npm@5</em>.  I now have a <em>package-lock.json</em> file with everything from <em>package.json</em>.  I would expect that, when I run <code>npm install</code> that the dependency versions would be pulled from the lock file to determine what should be installed in my <em>node_modules</em> directory.  What's strange is that it actually ends up modifying and rewriting my <em>package-lock.json</em> file.</p>
  
  <p>For example, the lock file had typescript specified to be at version <em>2.1.6</em>.  Then, after the <code>npm install</code> command, the version was changed to <em>2.4.1</em>.  That seems to defeat the whole purpose of a lock file.</p>
  
  <p>What am I missing?  How do I get npm to actually respect my lock file?</p>