What is the NPM equivalent of "yarn install --frozen-lockfile"?

Question

I'm using npm as part of me building the production docker image. I want to make sure the package-lock.json doesn't change and matches.

Answer 1

You can use npm ci.

npm ci bypasses a package’s package.json to install modules from a package’s lockfile. This ensures reproducible builds—you are getting exactly what you expect on every install.

https://blog.npmjs.org/post/171556855892/introducing-npm-ci-for-faster-more-reliable