title: How do I npm update dependency versions in the package-lock.json?
body: <p>As in the title, but:</p>
  
  <ul>
  <li>If it is possible, I don't want to hand-rewrite the version string manually in the package-lock.json,</li>
  <li>I tried the following: <a href="https://stackoverflow.com/questions/16073603/how-do-i-update-each-dependency-in-package-json-to-the-latest-version">How do I update each dependency in package.json to the latest version?</a> but of course as expected, it only updated the package.json file,</li>
  <li>I looked at the docs: <a href="https://docs.npmjs.com/files/package-lock.json" rel="nofollow noreferrer">package-lock.json docs</a> and <a href="https://docs.npmjs.com/files/package-locks" rel="nofollow noreferrer">package-locks explanation docs</a>,</li>
  <li>as written in <a href="https://stackoverflow.com/questions/45022048/why-does-npm-install-rewrite-package-lock-json">this question</a>, the npm install behaviour was changed in npm v5.1.0, which if I'm correct, means that if I have npm version higher than 5.1.0, my app will (by default) always npm install from tha package.json, instead of the package-lock.json. However, I still have a dependency listed in my package-lock.json which has a vulnerability, and my github is screaming warning for it.</li>
  </ul>
  
  <p>How to best solve this? If I'm installing from package.json anyway, is it a good practice to just delete the package-lock.json? Should I rather keep it updated? What to do if I want to use the lock instead?</p>
  
  <p>I have never done anything like this before, so I'm not even sure that if I just rewrote a version string in the json it would work or break the npm install.</p>
  
  <p><strong>Is there a safe/professional way to change to package-lock.json, and keep it updated via npm?</strong></p>