Lockfiles in Node do not work well. Many projects outright disable them and instead pin dependencies. They were designed and implemented in a rush, and it shows.