That’s how you get tons of security vulnerabilities. It’s not a perfect solution but I rather have npm updating versions automatically, because developers are lazy and rarely do it manually.