Yes, package.lock is used by default now. But when you do want to update the dependencies. It will update thousands of libraries at the same time. However it i

Yes, package.lock is used by default now. But when you do want to update the dependencies. It will update thousands of libraries at the same time. However it is a problem of the eco system, not package manager.