npm install, will pin the libraries to exact specific versions. It is also possible (and recommended) to do that in Python via
This allows for strong reproductibility: you always know what is built from what.
The drawback is that one ends up with outdated libraries, which may not be a problem when there are good tests (you may use a "feature" which is actually a bug, but this may not matter since it works and passes the tests), except that there may be security vulnerabilities, and you will be unaware of these.
My question: why is there a default to pin the exact version, instead of the major one?
My understanding is that depending on the libraries, "major" may mean different things and "minor" versions may still break things even if the use of the library was according to the documentation (and not a bypass/shortcut/non-documented feature).
On the other hand, if a library cannot decide on non-breaking changes for documented usage, it may not be a good library to start with.