Just updated from npm 3 to 5, to use this feature.
Sorry, I must be missing something totally obvious, but how do make npm respect the pinned versions in packa
You need to use the npm ci command to install from package-lock.json.
npm ci
package-lock.json
See: https://blog.npmjs.org/post/171556855892/introducing-npm-ci-for-faster-more-reliable