One thing I might add to #2:
npm config set save-exact true
This will make any invocations of npm i package --save and npm i package --save-dev nail down the latest currently available version of package without making you have to remove the caret manually. And yes, npm i is a default alias for npm install (as is npm isntall while I'm at it).