Package integrity and yarn.lock/package-lock.json

You can click “Download code” to view the latest revision id …

… which you can then insert into your tarball URL. Unfortunately this won’t affect any non-pinned dependencies inside the notebook.

I’m not familiar enough with either npm or yarn to know if there’s a custom resolver plugin API thingy that would allow to properly convert all dependency URLs, but if there was I’d imagine it could solve these kinds of problems.