[riking]

Nope, you need to run `npm ci` to guarantee that you don't write a new lockfile.

[hashhar]

Also the lockfiles are not recursive. i.e. they don't apply to the dependencies you install or their transitive deps.