The lock concept isn't at all unique to npm/yarn because you need some form of checksum/hash verification. Even if you trust your source that's unlikely to be p

The lock concept isn't at all unique to npm/yarn because you need some form of checksum/hash verification. Even if you trust your source that's unlikely to be part of a repo and doesn't guarantee the next developer can trust what they get. Availability is a concern, but again if you have it once you have some way of including it in the project. I think there's a security nightmare with anything that's going to end up in browser at some point. It's such an exploitable surface. And PHP was not a thoughtfully designed language, but the bad part wasn't the fact that remote includes were possible but that there was no attempt at sandboxing or security built into the functionality. I'm not sold on Deno for what it's worth. I do agree with you on interpreter not really needing to be in charge of package management, but compilers do it all the time and most typescript ends up getting compiled or transpiled anyway.