Install -f overrides package json

[sudodoki]

Given I have in my package.json
"compy": {
"main": "Main.js",
"dependencies": {
"edjafarov/socker": "master"
}
}
compy install and compy install -f won't update my compy entries, but
compy install -f edjafarov/socker will update it and set version to '*'.
Is it as planned?
Can master branch be ahead of '*' ~latest release? Thus making dependency broken in case it has some sort of fix that wasn't part of release yet.
Maybe, compy should introduce some sort of update verb to safely get the latest component matching package version?