node locks down dependencies for you, not only the version, but it saves a hash too. The problem is that npm install will install the newest version allowed i

node locks down dependencies for you, not only the version, but it saves a hash too. The problem is that npm install will install the newest version allowed in your config, and re lock it. However if you run npm ci, it will only install what is locked, and fail if the hashes don't match. in python pipenv works the same way, pipenv sync will only install what is locked, and will check your hashes. I'm not sure about poetry.