“A new developer clones the repo and gets wildly different dependency versions than the previous devs tested with.”

Could you describe a scenario where you think this happens? It doesn’t if you have a lock file in version control. Do you mean if it’s not in version control?