"npm i" does not respect the package-lock.json file, fetches bad version and changes file

Question

The package-lock.json file has the particular version of a package, however after running "npm i" a later version is installed, and the package-lock.json file has been updated to reflect the later version.

1. Why is this happening? I thought the package-lock.json file was the absolute source of truth.

2. How to prevent it?

Answer 1

Maybe you meant

npm ci

The npm i is a short form for npm install which uses the package.json file.

ci stands for clean install (see doc) and should never update automatically but use the package-lock.json, which itself will be generated.