Lesson 17 of 30

Semantic Versioning & npm

Q: What's the difference between ^1.2.3 and ~1.2.3 in package.json, and why does a lockfile matter alongside them?

A strong answer covers: MAJOR.MINOR.PATCH: breaking / backward-compatible feature / backward-compatible fix; ^ allows minor+patch updates within the same major version; ~ allows only patch updates — both are ranges, not exact pins; A lockfile pins the exact resolved version for reproducible installs, which is what CI's --frozen-lockfile relies on.

A version number that's actually a promise: MAJOR.MINOR.PATCH, where each position means something specific about what kind of change happened — not just an incrementing counter.

11 min read

Check your understanding

Every option explains itself — why the right one is right, and why each wrong one is wrong. Miss one and it comes back later on a spaced-repetition schedule.

Question 1 of 2

package.json lists `"lodash": "^4.17.21"`. Does npm/pnpm guarantee your install always resolves to exactly 4.17.21?

No — the caret allows any 4.x.x update; a lockfile is what actually pins the exact resolved versionYes — a caret range always resolves to exactly the version written in package.jsonYes, but only if node_modules already exists from a previous install

Stuck? Ask the AI tutor

Hints without spoilers, and a plain explanation of why a wrong answer was wrong — answered only from this lesson. Free account, no card.

Interview questions on Semantic Versioning & npm

What interviewers actually ask about this, and what a strong answer has to cover.

What's the difference between ^1.2.3 and ~1.2.3 in package.json, and why does a lockfile matter alongside them?

A strong answer covers

MAJOR.MINOR.PATCH: breaking / backward-compatible feature / backward-compatible fix
^ allows minor+patch updates within the same major version; ~ allows only patch updates — both are ranges, not exact pins
A lockfile pins the exact resolved version for reproducible installs, which is what CI's --frozen-lockfile relies on

Likely follow-ups

Is semver actually enforced by npm, or is it a convention authors are trusted to follow?
Why might a --frozen-lockfile install fail in CI when it works fine locally?
Should you always avoid upgrading past a major version bump?

Practice these with the AI interviewer →

The plain-language idea

Semantic Versioning (semver) gives MAJOR.MINOR.PATCH (e.g. 2.4.1) a precise meaning:

MAJOR bumps on a breaking change — code using the old version might now fail.
MINOR bumps on a new, backward-compatible feature — old code keeps working, new capability is added.
PATCH bumps on a backward-compatible bug fix — behavior gets closer to what was intended, nothing that relied on it should break.

"dependencies": {
  "lodash": "^4.17.21"    // ^ allows 4.x.x, but not 5.0.0
}

^ (caret) allows any MINOR or PATCH update but blocks MAJOR — the standard default, trusting that a MINOR/PATCH bump genuinely won't break your code. ~ (tilde) is stricter, allowing only PATCH updates.

Semver: a version number that's also a promiseStep 1 of 3

1.4.2 → MAJOR.MINOR.PATCH — each number means something specific about what changed.

What people usually miss

Watch out

package.json's version ranges (^4.17.21) don't pin an exact version — two different pnpm install runs, days apart, could resolve to different actual versions within that range, unless a lockfile (pnpm-lock.yaml) pins the exact resolved versions for reproducible installs.
A lockfile is what CI/CD (from the CI/CD lesson) actually relies on for reproducibility — installing --frozen-lockfile fails the build if package.json and the lockfile have drifted apart, catching a class of "works locally, breaks in CI" bugs before they ship.
A MAJOR version bump doesn't mean "avoid it forever" — it means "read the changelog before upgrading, some code may need to change" — many major bumps are small, deliberate, well-documented breaking changes, not a sign of instability.

Why this matters in interviews

"What's the difference between ^1.2.3 and ~1.2.3 in package.json, and why does a lockfile matter?" is a very practical, common question — knowing that semver is a convention (not an enforced guarantee) and that lockfiles are what actually pin reproducibility shows real day-to-day dependency-management experience.