Integrity checks are important, but an even more basic benefit obtains regarding version ranges. Typical package.json dependency entries specify _ranges_ of ver

Integrity checks are important, but an even more basic benefit obtains regarding version ranges. Typical package.json dependency entries specify _ranges_ of versions that will satisfy the dependency, rather than a single specific ("pinned") version. So it's by design, and fully to be expected, that over time, subsequent builds will yield different results as library authors publish newer versions which still satisfy the version ranges. Knowing when this has happened, and being able to diff the results in the dependency graph, is a key feature of lockfiles. A proper lockfile implementation (like yarn's) provides deterministic builds, so anyone building the project with the same lockfile gets precisely the same dependency graph. You get the benefits of version pinning without the downside.