Hacker News Reader

That's what .lock files do though.

Not sure if that is even enough, at least in NPM the .lock files work on semantic versions, not commits. I'm not sure if NPM enforces you to change the semantic version with each commit.

And even if all of that works, you still run head first into the issue once you inevitably upgrade the dependencies.

Yarn at least includes a hash of the tarball in the lockfile, so even if npm’s immutability fails somehow you’ll at least know.

Then the package manager should be changed to make it more convenient.

There is no way around the issue because "dependency hell" is indeed a thing.

Dependencies change. Dependencies of dependencies change. You can't not update any of your dependencies for too long or there will be other problems. Something is gotta give.

This is why I’ve warmed up to Nix, pinnacle of dependency management IMO