"Safe mode": Only resolve dependencies listed via provided package.json

[n1ru4l]

Right now the bundler tries to resolve any dependency with the latest version from unkpg. It should be possible to provide an entry package.json (and probably also package-lock.json) that restricts the packages that will be resolved.