&gt; It baffles me that automatically update your dependencies is considering the right thing to do.<p>The idea is to rely on semver. If you do ~1.3.4 in your dependency then if that dependency follows semver properly, you&#x27;ll get 1.3.5 if it&#x27;s out, and your stuff will still work, but you&#x27;re getting bug fixes and patches without having to keep an eye on the sometimes hundreds of dependencies. Luckily tools like greenkeeper.io are around now.<p>The drawback is many people don&#x27;t follow semver, so I opt to appending --save-exact to all npm installs (actually have npm config set save-exact true)