After dealing with some annoying side-effects as part of T340590 (including a minor SVGO patch update that leads to hundreds of new SVG files getting built as part of npm run test due to a small change in compression approach), I think we should adopt a strict versioning policy in regard to dependencies.

We should lock all packages that Codex depends on to exact versions, and periodically go in and update them (perhaps once per quarter).

In a perfect world this would not be necessary, but too much of the Node ecosystem sees semver as a polite suggestion as opposed to a mandate – we don't want to inflict these changes on our own users without clearly understanding each one.