Since nobody else answers your question: > Do they just mean package.json here? ...

		hobofan 3 months ago \| parent \| context \| favorite \| on: Pnpm has a new setting to stave off supply chain a... Since nobody else answers your question: > Do they just mean package.json here? Yes, most likely. A package-lock.json always specifies an exact version with hash and not a "version X or newer".