[nickpresta]

I'm of the opinion that if you're relying on semver for automated depenency management (like npm), you're doing it horribly wrong.

Pin your dependencies to specific versions, read changelogs and make informed decisions.

Don't rely on someone bumping patch versions correctly to keep your software stable.

I tend to agree with Jeremy Ashkenas on this issue: https://gist.github.com/jashkenas/cbd2b088e20279ae2c8e