Yeah, it can be done easily using lockfiles, both yarn and npm allow that. You would seldom run npm update directly in production without testing the updated deps first
Okay this is bad. I had just convinced management to get us on Bronze Plan, now it's gone. Intially the whole team ~10 Dev's were in Bitbucket, was considering between GitHub and GitLab since Gitlab allowed importing pull request issues, whereas GitHub support just asked me to write my own plugin for the same.