title: How do I fix a vulnerable npm package in my package-lock.json that isn't listed in the package.json?
body: <p>Github is telling me that a dependency in my package-lock.json file is vulnerable and outdated. The problem is that if I do <code>npm install</code> or <code>npm update</code>, neither of them update the dependency in the package-lock.json file. </p>
  
  <p>I've done a lot of googling on this, as well as deleted the file and done <code>npm install</code>.</p>
  
  <p>If anyone can help resolve this I'd hugely appreciate it. The package in question is Hoek, which I don't actually have in my package.json file. </p>
  
  <p>Many thanks in advance.</p>