just spent 2 hours debugging a bug that was caused by a dependency update that was only 2 minor versions ahead. can we please just freeze npm versions in time or something?