In JS world we got a package lockfile fairly recently. Locking your own package.json version wasn't enough because packages have deps too. Beforehand running n

In JS world we got a package lockfile fairly recently. Locking your own package.json version wasn't enough because packages have deps too. Beforehand running npm install on newly checked out repos was a gamble, especially given that we have packages for every minute "feature" like leftpad (which is a horror story of its own).