Not an answer, per se, but an observation that seems to have been overlooked.
The description for carat ranges:
see: https://github.com/npm/node-semver#caret-ranges-123-025-004
Allows changes that do not modify the left-most non-zero digit in the [major, minor, patch] tuple.
Means that ^10.2.3
matches 10.2.3 <= v < 20.0.0
I don't think that's what they meant. Pulling in versions 11.x.x through 19.x.x will break your code.
I think they meant left most non-zero number field
. There is nothing in SemVer that requires number-fields to be single-digit.