I think even when using semver, you should lock down your dependencies (e.g. npm shrinkwrap). My approach is often to periodically delete npm-shrinkwrap.json, G

I think even when using semver, you should lock down your dependencies (e.g. npm shrinkwrap). My approach is often to periodically delete npm-shrinkwrap.json, Gemfile.lock, composer.lock, etc. and then install updated dependencies and thoroughly test things. You still get the benefit of a reasonably loose specification of what versions of dependencies you expect to be compatible with, but additional security in knowing that you won't be surprised by unexpected breaking changes.