> Something somewhere in the dependencies hadn't been screwed down tightly enough, and everything was broken.

The package-lock.json file and the `npm ci` command should take care of any issues like that nowadays. Yarn has also always had its lock file. I wonder what was the root cause here? Did your repo have some deps coming from some other registry than npmjs.com?