> The complaint seems to be that the update command is not sufficiently safe by default This is not the case in NPM. `npm update` will only update to the lates

> The complaint seems to be that the update command is not sufficiently safe by default This is not the case in NPM. `npm update` will only update to the latest version that matches the selector in your `package.json`. So if you ran `npm install --save` and it wrote 'foo@^1.2.3', `npm update` will not update to release 2.0.0 which includes breaking changes, but will update to 1.2.5 which includes fixes. The ^ symbol is the default which will allow new features and fixes, but not breaking changes. You can optionally set '~' on a conditional basis or npm-wide default for fixes only, or pin packages only if that's your fancy. But the default seems pretty sensible in my opinion.