NPM update does not respect sym-ver settings in package.json

[PikaChokeMe]

I'm opening this issue because:

• [ x ] npm is doing something I don't understand.

What's going wrong?

According to documentation here https://docs.npmjs.com/cli/update
the update command is suppose to update and save versions according to the sym ver settings I currently have set in my package.json; however, it actually seems to just ignore this and append ^s to everything.

How can the CLI team reproduce the problem?

Take something like this package.json

  "dependencies": {
    "@angular/animations": "^4.0.0",
    "@angular/common": "^4.0.0",
    "@angular/compiler": "^4.0.0",
    "@angular/core": "^4.0.0",
    "@angular/forms": "^4.0.0",
    "@angular/http": "^4.0.0",
    "@angular/platform-browser": "^4.0.0",
    "@angular/platform-browser-dynamic": "^4.0.0",
    "@angular/router": "^4.0.0",
    "@angular/upgrade": "^4.0.0",
    "@ngrx/core": "^1.2.0",
    "@ngrx/store": "^2.2.2",
    "core-js": "^2.4.1",
    "rxjs": "^5.1.0",
    "zone.js": "0.8.12"
  },

And delete the node_modules folder. Then run npm upgrade --save and notice that something like
"zone.js": "0.8.12"
is transformed into
"zone.js": "^0.8.13"
The carrot now ruins the statically set semantic versioned value of "0.8.12"

supporting information:

• npm -v prints: 5.3.0
• node -v prints: 6.9.1
• npm config get registry prints: https://registry.npmjs.org/
• Windows, OS X/macOS, or Linux?: Windows 10
• Network issues:
  • Geographic location where npm was run:
  • I use a proxy to connect to the npm registry.
  • I use a proxy to connect to the web.
  • I use a proxy when downloading Git repos.
  • I access the npm registry via a VPN
  • I don't use a proxy, but have limited or unreliable internet access.
• Container:
  • I develop using Vagrant on Windows.
  • I develop using Vagrant on OS X or Linux.
  • I develop / deploy using Docker.
  • I deploy to a PaaS (Triton, Heroku).