[Soremwar]

Hence why developers always recommend to use immutable sources when importing modules

[andrewmcwatters]

The web isn't immutable.

[Soremwar]

"Immutable" in the sense that packages can't be taken down or modified by authors

If you wanna take it a step further, you can always opt in to that lock file with various degrees of strictness as you yourself mentioned