> Code smells if a change works with one lockfile but not another generated around the same time. This isn't true at all. You can't predict when a new, potenti

> Code smells if a change works with one lockfile but not another generated around the same time. This isn't true at all. You can't predict when a new, potentially breaking, version of a dependency might get published. It could happen a second after you generate your lockfile, or create your PR. At time of PR creation we could have versions 1, 2, 3 and 4 of our transitive dependencies. At time of merge we could have versions 1.1, 2.2, 3.3 and 4.x available. Dependencies are outside of your control, so always "smell", that's why it's crazy to do anything other than pin the heck out of them.