Package-lock.json pins only first-order dependencies

Doesn't using `npm ci` instead of `npm install` keep transitive dependencies pinned as well?