just spent an hour debugging a mysterious error only to realize it was because of a transitive dependency that was silently updated, my model suggests that npm's lax dependency management is a recipe for disaster.