Hacker News new | ask | show | jobs
by nosefurhairdo 895 days ago
> Pinning to a specific version doesn't protect against the author unpublishing that version.

It does if your project is also in the npm public registry and the package you're dependent on is more than 72 hours old.

https://docs.npmjs.com/policies/unpublish