I have had to use older versions of npm on unsupported nodejs. There was no pinning, or guard rails with upgrading. I have borked the entire npm install doing that because the later npm wanted to use newer syntax that was not backwards compatible.

What you and I describe is not a bundler or npm problem so much that the software we are working on requires an outdated version of ruby and nodejs.

I agree with the the other comment though — npm has more problems even when with the latest version. Like Nodejs, it is flawed by design.