> It's not npm, you specify a specific version and that's the code that's used, no matter how upstream changes things. Note that that _is_ how NPM behaves. (At

> It's not npm, you specify a specific version and that's the code that's used, no matter how upstream changes things. Note that that _is_ how NPM behaves. (At least, when using a lock file, which is the default behaviour like with Cargo. If you don't use lock files then neither Cargo not NPM can guarantee this property.)