[BUG] npm install --package-lock-only on optional dependencies causes package-lock.json to change

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I have a package.json and a package-lock.json.
Inside the package.json, a certain package is in the optionalDependencies.
Everything works fine doing npm install --include=optional and that doesn't edit package-lock.json.

I tried to upgrade the package. So I did npm install jest-puppeteer@^6.1.0. Looking good. The package is still only listed in optionalDependencies but of course the version changes and there are some changes in package-lock.json. Same happens when I use npm install jest-puppeteer@^6.1.0 --include=optional.

But in CI, we have a check that's been helping us protect against pull requests where people have manually edited the version in package.json instead of using proper npm install .... That check is:

npm install --package-lock-only --ignore-scripts --include=optional

But when you run that, it exits with 0 but it edits the package-lock.json!

diff --git a/package-lock.json b/package-lock.json
index f6a90aa29bd..9bbb0ff0666 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -45,7 +45,6 @@
         "hot-shots": "^9.0.0",
         "html-entities": "^2.3.2",
         "imurmurhash": "^0.1.4",
-        "jest-puppeteer": "6.1.0",
         "js-cookie": "^3.0.1",
         "js-yaml": "^4.1.0",
         "kleur": "4.1.4",

Or CI also, immediately after, runs git diff --exit-code which basically means, this PR would cause a diff.

Expected Behavior

That package-lock.json doesn't change when you run npm install --package-lock-only --ignore-scripts --include=optional

Steps To Reproduce

1. Check out this repo as of this SHA: https://github.com/github/docs/tree/3cd87b09fac8ca9600c8179a7a9ab9b33d26c92d
2. Run npm install --include=optional
3. Now, to upgrade run npm install jest-puppeteer@^6.1.0
4. This should make changes to package.json and package-lock.json. Make a copy of those edits by committing them in a branch or doing cp package-lock.json /tmp.
5. Run npm install --package-lock-only --ignore-scripts --include=optional to test that it can install again without having to mutate the lock file.
6. See what happened to the package-lock.json. E.g. diff /tmp/package-lock.json package-lock.json

Note, in our project we almost never upgrade packages. We let Dependabot do it for us. It exhibits the same problem as when I'm trying to do it manually.

Environment

• npm: 8.1.0
• Node.js: v16.13.0
• OS Name: macOS
• System Model Name:
• npm config:

; copy and paste output from `npm config ls` here

Reproduce the behavior in the linked github/docs revision using package.json, package-lock.json, and the listed npm commands. Compare the lockfile before and after npm install --package-lock-only --ignore-scripts --include=optional; done means the command exits successfully without changing package-lock.json.