> Even with npm's ability to have multiple versions of each library at once, you don't want to have to ship a new version every time one of your dependencies do

> Even with npm's ability to have multiple versions of each library at once, you don't want to have to ship a new version every time one of your dependencies does. Nothing about using == forces you to ship a new version every time one of your dependencies does. When your dependencies ship a version, this changes nothing for you if you're using ==. In fact, >= is much more likely to force you to ship a new version when one of your dependencies does, because a breaking change in your dependencies can break your code. And when a breaking change breaks your code, it does so without warning. >= is a cause of your problem, not a solution. > Even if you don't mind the hassle, you'd still making it harder for your users to promptly install security fixes. If you're worried about security, then you shouldn't be shipping arbitrary dependency updates to your users, you should be evaluating the security of each release before pushing them out. And honestly, if you're writing security-critical code, you shouldn't be using a language that dumps everything into a global namespace. "JavaScript security" is an oxymoron.