Yes, if you put exact versions in your package.json and do not prefix them with a caret or tilde, npm will install the exact version. A package-lock.json version will also pin your transitive dependencies to a specific version. Unfortunately, the default behavior of npm is to add a caret to the version number which npm interprets as this version or any greater minor/patch release.