I turn that off whenever I setup a new computer. I too want my packages to be exact. It has only ever caused me pain. Mainly around a package author introducing

I turn that off whenever I setup a new computer. I too want my packages to be exact. It has only ever caused me pain. Mainly around a package author introducing a breaking change in a minor/patch version (which I actually don't fault them for). I see ranges as "wobbly" foundation and the more dependancies on dependancies you have the "wobblier" your foundation becomes. I've spent hours tracking down some mid-depth dep that was being installed with a range that had deps that had a range that had deps that had a range and because of this a new "npm install" or update causes a massive jump in version of some very low-level library that DOES have a breaking change that propagates up. It's all a house of cards. Any package manager I use for software development I lock down versions as tight as I can. If I have a problem I'll go read the change log, commit log, release notes, etc for the library in question to see if they have a fix for the issue I am having but blindly hoping everyone follows SEMVAR to the letter and doesn't just miss something they didn't test for is laughable.