[IanCal]

This is usually managed with lock files.

Package spec puts down what it should work with, you pin a specific version in that range for your app that you've tested.

Otherwise updating things will never happen. Unless you have full separation between upstream dependencies (so you can have multiple versions at the same time) - and that brings huge questions - a single dep 3 steps away can stop you upgrading.

Ranges also communicate "this doesn't work with later than X" as well.