How to enforce package-lock.json

[hrishikesh]

None that I’m aware of. npm install seems to ignore it, and we don’t support npm ci yet. I believe yarn respects yarn.lock?