Semver seems like a huge problem here, blindly pulling in changes is just asking for a lot trouble, intentional or not. I'd also say NPM's centralized naming s

Semver seems like a huge problem here, blindly pulling in changes is just asking for a lot trouble, intentional or not. I'd also say NPM's centralized naming structure is also problematic, people don't want to update 1000's of modules to some new latest version of X which was forked and is now maintained, so it's handed off like this.