[BUG] when using npm install, package.json has no change, but package-lock.json automatically changed

[1036875207]

devDependencies @vue/cli-service
@vue/cli-service requires "vue-loader-v16": "npm:vue-loader@^16.0.0-beta.7"

while using npm install, package-lock.json auto updated vue-loader-v16,
for keeping exactly the same dependencies, package-lock.json should not get auto updated

npm version 6.14.8

[ljharb]

What happens in npm v7.1.2?

[1036875207]

What happens in npm v7.1.2?

npm v7.1.2

vue-loader-v16 also get auto updated to @16.1.1