NPM and Yarn have made a nightmare out of our project. We have 50 direct dependencies. The lockfiles only lock your direct dependencies, any transitive ones can change at any moment, making our CI builds fail when something works locally. And they don't actually check integrity -- that v1.5.0 of ABC is the same as v1.5.0 from a month ago.<p>I saw Yarn added last month a hash of the (hopefully) source of the dependencies -- that's what we need.<p>Despite using lockfiles, some transitive dependency changed and we decided it was best to upgrade the direct dependency, requiring a big refactor. The alternative was to fork the library and maintain it ourselves -- which I am refusing to do from this point on. We have about 10 forked 3rd party libraries. No more.<p>I feel like I spend 30% of my time just trying to upgrade/maintain the current builds because some stupid loosely semver'd dependency changes, rather than writing new features.