Is there a way to confirm a package-lock.json actually resolves all dependencies in a package.json? : <p>We want to add an automated check to our CI server that would prevent code from getting committed that updates a dependency in <code>package.json</code> but does not update the resolved dependency in <code>package-lock.json</code>.</p>

<p>This could happen if, for example, someone updated a dependency in <code>package.json</code> manually but ran <code>npm install</code> instead of <code>npm update</code> (<code>npm install</code> favors <code>package-lock.json</code>, if present). Or it could happen even if someone runs the correct <code>npm</code> command when updating a dependency but then forgets to commit the resulting changes to <code>package-lock.json</code>. We try to watch for these things in code review, but an automated check would definitely be better. Is there any <code>npm</code> command that does this?</p>

<p>Here's an example to illustrate.</p>

<p><strong>Before</strong>:</p>

<pre><code>// package.json
{
    "lodash": "~3.1.0"
}

// package-lock.json
{
    "dependencies": {
       "lodash": {
           "version": "3.1.3"
       }
    }
}
</code></pre>

<p>Someone updates <code>package.json</code> but forgets to commit the change to <code>package-lock.json</code>.</p>

<p><strong>After:</strong></p>

<pre><code>// package.json
{
    "lodash": "~3.2.0"
}

// package-lock.json (not changed)
{
    "dependencies": {
       "lodash": {
           "version": "3.1.3"
       }
    }
}
</code></pre>

<p>Now <code>package-lock.json</code> no longer reflects a valid set of dependency resolutions for the <code>package.json</code> file.</p>
