title: How to have NPM have exact versions for transitive dependencies?
body: <p>Our <code>.npmrc</code> file has the following to lock the runtime and dependencies to be exact versions:</p>
  <pre><code>#Make sure that we use the expected node and npm versions
  engine-strict=true
  save-exact=true
  </code></pre>
  <p>This <em>mostly</em> avoids the 'well, it's working on my computer issue' by writing exact version numbers in <code>package.json</code>.</p>
  <p>However, I noticed that the transitive dependencies on <code>npm install</code> are still bringing in <code>^4.5.6</code> which re-opens the hole again. Is there a setting in <code>.npmrc</code> to make these fixed versions as well, so that all developers on the team are 100% on the same versions?</p>
  <p>Specifically, when <em>any</em> developer runs <code>npm install xxxx</code>, it should never write <em>any</em> <code>^4.4.4</code> versions, transitive or not. The direct ones were fixed but transitive ones are still going into <code>package.json</code> as <code>^4.4.4</code>.  Over time, this leaves every developer on different versions of modules at the same git hash and we have a very hard time comparing different environments. Worse is when you check out code from 6 months ago and it uses different versions than you ran in production.</p>