> It baffles me that automatically update your dependencies is considering the right thing to do. The idea is to rely on semver. If you do ~1.3.4 in your depen

> It baffles me that automatically update your dependencies is considering the right thing to do. The idea is to rely on semver. If you do ~1.3.4 in your dependency then if that dependency follows semver properly, you'll get 1.3.5 if it's out, and your stuff will still work, but you're getting bug fixes and patches without having to keep an eye on the sometimes hundreds of dependencies. Luckily tools like greenkeeper.io are around now. The drawback is many people don't follow semver, so I opt to appending --save-exact to all npm installs (actually have npm config set save-exact true)