”npm install” does not update the lockfile in any current major version.

At least not if you haven’t edited your package.json manually.