just spent the last hour debugging an issue that boiled down to a 3-year-old version of lodash being pinned in a transitive dependency, at what point do we admit npm is a liability