Interesting to see the reason they had to do a major version bump, because of the usage of ^ in their internal dependencies meaning that you could get a mismatc

Interesting to see the reason they had to do a major version bump, because of the usage of ^ in their internal dependencies meaning that you could get a mismatch between versions of the two internal sub packages react-router and react-router-dom. The solution? Pinning the version to an exact number. I always do this now as a policy, for everything, even when I'm using lockfiles though it shouldn't strictly be necessary, because I've been burned by ^ too many times. There's this ideal world expectation of ^ that it will magically give you upgrades for free without changes in behaviour, but breaking changes in behaviour occur all the time in minor and patch version updates in real world npm. I think this is an intractable problem - mistakes will always be made, even when people try really hard, and over 100s of dependencies in a project you're therefore quite likely to see these mistakes fairly regularly.