On: Dev corrupts NPM libs 'colors' and 'faker', breaki...

[Aeolun]

> I believe you should be guarded from any surprise patches

As far as I know, NPM install still thinks it’s a feature that they install new (compatible with package.json, but not with lockfile) versions.

[knute → Aeolun]

Which is why you only use `npm install` for development, and `npm ci` for production.

[Sharparam → knute]

No, updating versions should require an explicit `update` command of some sort. The NPM commands should really just be renamed:

- `npm install` should be renamed to `npm upgrade`

- `npm ci` should be renamed to `npm install`