Dependency version specifiers do not allow unintended breaking changes

A package.json with "some-library": "latest" or "another-lib": "*" means a fresh npm install six months from now could pull a breaking major version — silently. CWE-1357 applies: the project depends on whatever happens to be newest, not on a version it was tested against. SSDF PS.3 requires version-pinning as a supply chain control. This failure mode is especially dangerous in CI/CD pipelines that run npm install without a lockfile — a new release of a dependency can break production deployments without any code change.

Replace every *, latest, and unbounded >= specifier with a pinned or caret range:

// Before (dangerous):
"dependencies": {
  "some-library": "latest",
  "another-lib": "*"
}

// After (safe):
"dependencies": {
  "some-library": "^2.4.1",
  "another-lib": "^1.0.0"
}

Run npm install after updating specifiers to regenerate the lockfile, then commit both package.json and package-lock.json together. Caret ranges (^X.Y.Z) allow minor and patch updates but block major version jumps.