> dependency versions being fixed is a feature Pushing multiple versions of the same library is a bug. Semver ranges exist for a reason. > a dependency publis

> dependency versions being fixed is a feature Pushing multiple versions of the same library is a bug. Semver ranges exist for a reason. > a dependency published a semver-compatible update that broke something The same can happen with your direct dependencies too. Just use a lockfile and only update it when the install is successful. > In a web context this would break the app Absolutely not. Use lockfiles. Nothing breaks until you merge that update PR.