> package-lock.json helps solve the technical problem, but the JS community still has a cultural problem because JS packages are typically fine-grained, release

> package-lock.json helps solve the technical problem, but the JS community still has a cultural problem because JS packages are typically fine-grained, released frequently, and upgraded without much thought. Just the other day I caught myself feeling frustrated that I had to manually add a dependency + version number in my mix.exs (Elixir package manager), just because I got so used to doing 'yarn add <package>'. And that's despite the fact that I for quite a while now I have also been feeling a bit weird about just adding packages to my project for the exact reason discussed here (as well as the 'leftpad' fiasco). It's both fascinating and a bit scary how easy I just do things 'the way everyone does' despite knowing better, and I hope we'll find some solution that could be applied community- or ecosystem-wide.