The default behaviour is a safe semver selector.<p>If I type &quot;npm install --save foo&quot;, it gives me &quot;^1.2.3&quot; which says &quot;everything compatible with the current version&quot;.<p>If you don&#x27;t follow semver specification and make incompatible changes, well, :(<p>You also have the wonderful npm shrinkwrap command (<a href="https:&#x2F;&#x2F;docs.npmjs.com&#x2F;cli&#x2F;shrinkwrap" rel="nofollow">https:&#x2F;&#x2F;docs.npmjs.com&#x2F;cli&#x2F;shrinkwrap</a>) which locks you down similar to a Gemfile.lock, but inline with how the npm world works.<p>Thanks for tooting your horn about being senior while also being factually incorrect about the default behavior of node and not knowing you can use shrinkwrap to leave the loose version specifications but also commit what they actually resolved to on your machine.