[Feature] Global and project specific config to pin package version for npx

[hechang27-sprt]

the default behavior of always fetching for latest version does more harm than good. We NEED a way to keep agentic tools/workflows stable and working when they all use npx xxx and xxx might be broken in a new update.

[hechang27-sprt]

While using dev dependencies for this is sometimes workable, but that causes more bloat in package.json and node_modules.

[hechang27-sprt]

I really don't understand what's so desirable about the so-called "stateless" design, that's just impractical with today's npm rife with broken packages and supply-chain attack. While the default behavior of the fetching the latest package might be the most common denominator, as least give us the ability to opt out when needed

[ljharb]

That's not the default behavior, and a lockfile is how you lock versions. I'm a bit unclear what you're talking about.