How to deal with an unstable package-lock.json with yargs-parser

Question

I have a node project using npm with an indirect yargs-parser dependency.

Assuming the project is completly up to date (according to npm update), if I ru