I was bitten once a few years ago and have always pinned everything since then. And of course last year I was bitten by a ~ in a package.json that I hadn't got

I was bitten once a few years ago and have always pinned everything since then. And of course last year I was bitten by a ~ in a package.json that I hadn't got around to pinning in a code base I'd inherited.