I always thought that typing npm install, alone would install the package according to the package.json in the project directory, but I encountered a problem.
I used a set of react scaffolding configured by others, and then changed it and uploaded it to git. Git prompted me that there was a serious security loophole in the hoek2.16 version, so let me update the package. I took a look at the package.json, in the directory without the hoek package, but in package-lock.json, the version was 2.16, so I deleted the hoek, in the nodemodules. Change the version in package-lock.json to 4.2.1 after npm install.
the installed version is still 2.16! And 4.2.1 in package-lock.json has all become 2.16, search the entire document did not find where the definition of the version 2.16!