Package-lock.json pins only first-order dependencies (twitter.com) 2 points by mikehall314 4y ago ↗ HN
[–] metaloha 4y ago ↗ Doesn't using `npm ci` instead of `npm install` keep transitive dependencies pinned as well? [–] [deleted] 4y ago ↗ (comment deleted)
2 comments
[ 3.2 ms ] story [ 18.7 ms ] thread