Install dependencies
The lockfile
The lockfile pins every tarball by hash. Two machines get the same tree, to the byte. The cache is content-addressed and verified on read. For CI and release pipelines, run:--frozen refuses to guess. If anything in the tree would change, the command fails.
Speed and memory
Scenario times from the reference bench:
Peak memory during install is 9 MB. npm peaks at 698 MB and pnpm at 1.4 GB while doing the same work.