A dependency published a patch version with a breaking change and the author is on vacation? No problem, you can lock it within your project to the previous version.
Did you fork a dependency and you want to use your version? You can do that too. In all of your dependency chain. You can even change the version specifier to a git url so no need to publish your fork to the npm registry.
I whole heatedly recommend anyone to have a look at pnpm. As a unix dev, there's so much in there that is well thought and kept simple this fast.