And what about our beloved package-lock.json? It guarantees that all
dependencies and sub-dependencies are installed with a specific version, which
ensures that everyone building and executing the code gets a specific state (see
@ReproBuilds). #ESM only pins the top-level.