What is semantic versioning (semver) in npm?

Direct answer

Semver uses MAJOR.MINOR.PATCH — breaking changes bump major, backward-compatible features minor, bug fixes patch; npm ranges (^, ~, exact) control auto-upgrades; lockfiles pin resolved versions for reproducible builds.

Version strings like 2.4.1 communicate compatibility expectations — critical when dozens of packages compose AceDevHub's monorepo.

Segment	When it bumps	Example change
MAJOR	Breaking API	Removed export, changed signature
MINOR	Backward-compatible feature	New optional option
PATCH	Backward-compatible fix	Security patch, bug fix

^1.2.3 — allow >=1.2.3 <2.0.0 (default npm install range).
~1.2.3 — allow patch updates within 1.2.x.
package-lock.json — records exact tree; commit it for apps.
npm audit — surfaces vulnerable semver-resolved versions.

semver-ranges.json

{
  "dependencies": {
    "fastify": "^5.0.0",
    "pg": "~8.13.0"
  },
  "devDependencies": {
    "tsx": "4.19.2"
  }
}