This is not the default for NPM, Yarn, or PNPM. The "package-lock.json" is what does the pinning, and it's exact version. If you listen to very bad advice thou

This is not the default for NPM, Yarn, or PNPM. The "package-lock.json" is what does the pinning, and it's exact version. If you listen to very bad advice though, half of the Q&A answers on the Internet suggest all problems can be solved by deleting package-lock.json, to be fair.