How to enforce package-lock.json

The SHA errors do occur in Netlify builds…