> as long as package.json hasn't been updated, or update the lockfile if it has

There is a problem here: it will update the __entire__ package-lock.json file, regardless of the actual changes in packages.json.

Pinning doesn't help here if colors dependency is not your direct dependency.

So you can have a pinned library that doesn't pin colors.js. Now you make a change in packages.json (say adding or removing another unrelated package). You will end up with colors being bumped to latest.