They don't need to pin it directly. They only need to "npm ci" (based on package-lock.json) instead of "npm install" (based on package.json) within the Docker

They don't need to pin it directly. They only need to "npm ci" (based on package-lock.json) instead of "npm install" (based on package.json) within the Docker container to get a fully reproducible build.