Doesn't using `npm ci` instead of `npm install` keep transitive dependencies pinned as well?