Aliased package version is changed after running npm install

[sryze]

Hello,

I have two versions of core-js installed alongside each other like so:

"dependencies": {
    "core-js": "^2.6.5",
    "core-js3": "npm:core-js@^3.20.2",
}

Sometimes when I run npm install, the version of core-js3 changes to a newer version in package-lock.json, e.g.:

diff --git a/v2/package-lock.json b/v2/package-lock.json
index 5f2795eb56..7aa963c0d1 100644
--- a/v2/package-lock.json
+++ b/v2/package-lock.json
@@ -2517,9 +2517,9 @@
             }
         },
         "core-js3": {
-            "version": "npm:[email protected]",
-            "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.23.1.tgz",
-            "integrity": "sha512-wfMYHWi1WQjpgZNC9kAlN4ut04TM9fUTdi7CqIoTVM7yaiOUQTklOzfb+oWH3r9edQcT3F887swuVmxrV+CC8w=="
+            "version": "npm:[email protected]",
+            "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.23.2.tgz",
+            "integrity": "sha512-ELJOWxNrJfOH/WK4VJ3Qd+fOqZuOuDNDJz0xG6Bt4mGg2eO/UT9CljCrbqDGovjLKUrGajEEBcoTOc0w+yBYeQ=="
         },
         "core-util-is": {
             "version": "1.0.3",

Is there a way to lock the version of an aliased package so that it's not updated automatically during install?

I'm using Node.js v14.19.3 and NPM 6.14.17.

[MylesBorins]

If you want consistent behavior on install for aliased packages please update to npm 8.

[TacitusXI]

"^2.6.5" simply means that is compatible with 2.6.5 up to 3.0.0
"^3.20.2" simply means that is compatible with 3.20.2 up to 4.0.0
Try to lock your package versions by removing "^".
It's might help you)