Type a range from package.json (^1.2.3, ~1.2.3, 1.x, >=1.0.0 <2.0.0, ||) and see exactly which versions it accepts. Load the real version list of any npm package, or paste your own.
Try:
Expands to
>=1.2.3 <2.0.0-0
at least 1.2.3, below 2.0.0, and none of its pre-releases
Highest accepted version: 1.9.9 · 4 of 9 versions accepted
^ (caret) allows every change that does not modify the leftmost non-zero number: ^1.2.3 means >=1.2.3 <2.0.0, but ^0.2.3 means >=0.2.3 <0.3.0 and ^0.0.3 means only 0.0.3.
~ (tilde) allows patch changes when a minor is given: ~1.2.3 means >=1.2.3 <1.3.0. ~1 is the same as 1.x.
x, X and * are wildcards: 1.x is >=1.0.0 <2.0.0. A missing part counts as a wildcard, so 1.2 means 1.2.x.
Spaces mean AND, || means OR. A hyphen range 1.2.3 - 2.3.4 includes both ends; a partial upper end like - 2.3 means below 2.4.0.
Pre-releases (1.3.0-beta.1) are excluded unless the range itself names a pre-release on the same major.minor.patch. This is the rule that surprises people most.
Logic written to the node-semver 7 rules used by npm (strict mode, includePrerelease off) and checked against the semver package before release. Version lists come straight from registry.npmjs.org in your browser; nothing is sent to VersionDude.
A range floats. Your build machine should not.
A caret lets the next install pick a newer version; only the lockfile and the machine that runs npm ci keep builds reproducible. Infomaniak, a Swiss, privacy-respecting provider, offers VPS and cloud servers to run your own build and CI machines.