One nice property of Rust's cargo is that it generates a lock file by default. npm's shrinkwrap is good, but it's less discoverable.