haven't had that issue for years with npm/yarn, thanks to lockfiles.