Yeah, that statement was rather surprising. The lockfile does lock versions. The only time NPM will modify the lockfile on install is if you install a new depen

Yeah, that statement was rather surprising. The lockfile does lock versions. The only time NPM will modify the lockfile on install is if you install a new dependency or modify the package file to require a package version range that contradicts what's currently in the lockfile. So while it is possible that npm would modify the lockfile after a fresh clone, the only way that could happen would be if the package.json file was already out of sync with the lockfile on the branch you checked out.