Hacker News new | ask | show | jobs
by whilenot-dev 278 days ago
> packages published to npm are immutable.

Depends how you'd refer to them... tags ("@latest", "@next" etc.) are not immutable and it's best to rely on the checksums in the lock file.