3 ms·

That's what .lock files do though.

• bayesian_horse 5y ago
  Not sure if that is even enough, at least in NPM the .lock files work on semantic versions, not commits. I'm not sure if NPM enforces you to change the semantic version with each commit. And even if all of that works, you still run head first into the issue once you inevitably upgrade the dependencies.
  • epmatsw 5y ago
    Yarn at least includes a hash of the tarball in the lockfile, so even if npm’s immutability fails somehow you’ll at least know.