✅ Use the latest version of an ESM dependency: fine.
✅ Use the latest version of a CJS dependency: also fine.
❌ Pinning to a previous CJS major release that worked without issues after they bumped a major release for nothing other than ESM: ew, what? no—gross