Read the version range

Play this lesson

One caret

Remy's package.json for Shard Garden says "garden-physics": "^1.4.2". When Dependabot updates the lockfile, npm picks the newest version that range allows.

Three versions are out.

Try it

Find the one it won't install

Tap the version that ^1.4.2 does not allow.

Try it in the lesson

Quick check

Why does the caret stop before 2.0.0?

  1. A new major version may break things
  2. npm can't count past 1.9
  3. Version 2 is always unfinished
Show the answer

A new major version may break things

The caret keeps the left-most non-zero number fixed. Here that is the 1, so 2.0.0 is out of range.

Zero is different

node-semver's own example: ^0.2.3 means at least 0.2.3 and below 0.3.0.

Before version 1.0.0, the left-most non-zero number is the middle one, so the caret allows only patch updates.

Read the range

package.json
"leaf-ui": "^0.2.3"

Which version can npm install?

  1. 0.2.9
  2. 0.3.0
  3. 1.0.0
Show the answer

0.2.9

For ^0.2.3, the left-most non-zero number is the 2 in the middle. 0.2.9 keeps it; 0.3.0 and 1.0.0 change it.

The lockfile decides

With package-lock.json committed, every install builds the identical tree it describes. The range matters only when the lockfile itself is updated, in a pull request that the pipeline tests.

Quick check

With the lockfile committed, Kai and Remy can install different versions of garden-physics on the same day.

Show the answer

False

The lockfile names the exact version, so every install gets the same one until the lockfile changes.

On the studio board

The studio adds a decision to the board:

Every repo commits its lockfile. Dependabot's pull requests are merged within a week, and a security fix within a day.

Bolt says: Next: DDoS and bots.

Fact-checked 12 October 2026