npm install just took 10 minutes to fail because of a single outdated transitive dependency. Updating my priors: the tradeoff between convenience and security in package managers is still not worth it. Can we please just have reproducible builds already?