为什么我要运行两次npm install，package-lock.json也要更新两次？

Question

有人更新了package.json，但没有提交package-lock.json。然后其他人拉项目代码，然后node_modules为空，运行'npm install'，当然，package-lock.json被更新，再次运行'npm install'，package-lock.json也被更新。我想要的是后者package-lock.json。但是我不知道为什么吗？

1. 首先，主要区别是版本。

`

   "resolved": "http://rnpm.hz.netease.com/sdk-base/download/sdk-base-3.5.1.tgz",
    "integrity": "sha1-LhqSekVtlDJ9gCB0ZQB3x2fDEDo=",
    "requires": {
-       "await-event": "2.1.0",
-       "await-first": "1.0.0",
-       "co": "4.6.0",
-       "is-type-of": "1.2.0"
+       "await-event": "^2.1.0",
+       "await-first": "^1.0.0",
+       "co": "^4.6.0",
+       "is-type-of": "^1.2.0"
    }

`

1. 第二，添加新的依赖关系。

`

+        "binary-search": {
+            "version": "1.3.4",
+            "resolved": "http://rnpm.hz.netease.com/binary-search/download/binary-search-1.3.4.tgz",
+            "integrity": "sha1-0V9E/5Im7zCdhSR/oNv79lmVX1Y="
+        },
         "binaryextensions": {
             "version": "2.1.1",
             "resolved": "http://rnpm.hz.netease.com/binaryextensions/download/binaryextensions-2.1.1.tgz",
@@ -13289,7 +13294,7 @@
                     "resolved": "http://rnpm.hz.netease.com/async/download/async-2.6.1.tgz",
                     "integrity": "sha1-skWiPKcZMAROxT+kaqAKPofGphA=",
                     "requires": {
-                        "lodash": "4.17.10"
+                        "lodash": "^4.17.10"
                     }
                 },
                 "debug": {
@@ -14554,7 +14559,11 @@
         "measured-core": {
             "version": "1.40.1",
             "resolved": "http://rnpm.hz.netease.com/measured-core/download/measured-core-1.40.1.tgz",
-            "integrity": "sha1-DPW+DZfA69JavOthhdlt3U5ad+w="
+            "integrity": "sha1-DPW+DZfA69JavOthhdlt3U5ad+w=",
+            "requires": {
+                "binary-search": "^1.3.3",
+                "optional-js": "^2.0.0"
+            }
         },