I've had major trouble with the fact that the new package-lock.json doesn't sufficiently lock versions. In one working copy you can run "nom install" and everything works with no files or package-lock being changed. Yet, in another clean checkout, "npm install" brings in a different set of dependency versions despite having a -lock file, and things start to break. Yarn's yarn.lock seems to get this right.