> Write down your top-level dependencies. The computer will figure out transitive ones. They are guaranteed to be the same, since everything is immutable.

dep@ver can resolve to totally different outputs, depending on resolver (repository), DNS, time of day, user location, user network configuration, software author overrides, mistakes by anyone in the supply chain, etc.

everything is very obviously not immutable, this is one of the main motivations for lock files, checksums, etc.

dumb article :(