Every dependency was specified as "latest", so any install could pull a new major without the package.json changing. That is not theoretical: adding a type package to this repo's sibling pulled TypeScript 7, which svelte-check 4.x cannot load, and broke the typecheck. Each entry is pinned to a caret range on the version already installed, so today's tree is preserved exactly while majors now require a deliberate edit. The lockfile diff is specifier-only: no resolved version changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019YpBQ9y9mTyrB6aXMGgyeg