To be clear though, npm and yarn have not abandoned semver. Semver is still a good way of expressing dependencies. It's just that there are enough cases where it's not sufficient, and that's why lock files are in fashion this season. The underlying semver data is still there though, which is different to the sort of package manager which only records installed versions.