The lock file is the contract

Spent a day on a CI build that worked locally and failed on the runner. Same Node version, same lock...