Lockfiles get commited to the repo and used everywhere to avoid version differences. Upgrade dependencies as needed and have everyone reinstall when they change.

I'm amazed anyone wouldn't do this, it's the only sensible course of action.