My bad I meant `package-lock`, updated for clarity.

> Especially when the old project in question is not yours

Then it falls out of the stated scope of "updating my small website once every 5 years or so"