Can we please just freeze npm dependencies already? I'm so tired of "works on my machine" issues because someone's `package-lock.json` is out of date. Is reproducibility really too much to ask for?