The fact that install now uses the lockfile by default, mitigates this, I think.