As of npm v5.1.0, dependencies versions in package.json *override* the values specified in package-lock.json - View it on GitHub