its kind of a form of shrinkwrap, except it doesnt control the 3rd party module’s transitive deps