The only real change from the NPM case is speed of distribution of the end results, users don't need to consciously update. NPM has package and package-lock jus

The only real change from the NPM case is speed of distribution of the end results, users don't need to consciously update. NPM has package and package-lock just like there is cargo and cargo-lock, so devs are just as in control of the dependency versions they are shipping.