I worked with Node all the time and have not really found this to be a problem unless the package maintainer fails to publish a change log or fails to follow semvar correctly.