Don't forget too that npm by default allows minor version upgrades with the ^ prefix for version numbers, which means that unless you properly lock your dependencies, you can reintroduce changes over time, just by running npm install.