Package-lock.json pins only first-order dependencies

twitter.com

2 pointsmikehall3141 comment

Doesn't using `npm ci` instead of `npm install` keep transitive dependencies pinned as well?