> I have never had a package break between dev and prod when using versions like ^x.x.x. I've run into it. Dependencies get bugs sometimes. Easy to pin version

> I have never had a package break between dev and prod when using versions like ^x.x.x. I've run into it. Dependencies get bugs sometimes. Easy to pin versions with npm's shrinkwrap though. >The author advocates copy-pasting code rather than including small modules. To me this is very misguided. Yeah, I'm surprised how often people suggest this is the obvious solution as if it's not without its own problems. One of the things I dread most about working on a new codebase is finding an ancient version of some library code copy-pasted into the codebase with the inevitable unlabeled (and probably not high-quality) customizations made to it. Trying to figure out whether the library's documentation still applies, whether it still passes its original upstream tests with the customizations, or whether the copy can be safely replaced with a newer upstream version is painful.