Seems like the author's coworkers didn't follow semver, a feature/method was added in a minor release, they should have bumped the minor/minimum when bumping... locking to x.x.* is the new npm default iirc.