> Meanwhile, yarn, a popular npm alternative, will NOT respect a package author's wishes to lock transitive dependencies

Do you mean locking transitive dependencies across an upgrade of a direct dependencies? How does npm do that?