Yarn doesn't lock dependencies of published packages | Hacker News Reader