Semver encodes compatibility promises as `MAJOR.MINOR.PATCH`: a patch bump fixes bugs with no API change, a minor bump adds backward-compatible features, and a major bump can break the API.
In `package.json`, `^1.4.2` allows any `1.x.y` at or above `1.4.2` (locks the major version), while `~1.4.2` only allows patch updates within `1.4.x`. An exact `1.4.2` with no prefix pins that one version.
json
{ "dependencies": { "express": "^4.19.0", "left-pad": "~1.3.0", "critical-lib": "2.0.1" } }Respecting semver is a social contract, not something the tools enforce for you — a misbehaving package can still break your app on a "compatible" bump, which is why lockfiles and tests matter.