For what it's worth, w.r.t. your first point you can get part of the way there by creating a .npmrc in your project with "save-exact=true". Even if it doesn't p

For what it's worth, w.r.t. your first point you can get part of the way there by creating a .npmrc in your project with "save-exact=true". Even if it doesn't protect you from higher order dependencies that violate semver, it will peg all saved dependencies to an exact version (even by other engineers). But alas, even that sometimes doesn't give you any guarantees with the (albeit rare) force publish. Better than nothing, though.