>because no one locks down a dependency like is-string to a patch version. Is this actually true? Is this not what "package-lock.json" is intended to solve? (

>because no one locks down a dependency like is-string to a patch version. Is this actually true? Is this not what "package-lock.json" is intended to solve? (Not primarily a javascript developer)