I'd rather not be too clever, packages.json and fixed (well semver) version numbers are the way almost everything else is done in Node-land and what people will be used to :smile_cat: then if a package update breaks their test, they won't get a nasty surprise because the version is pinned.

If we want to make sure packages are up to date, we can always call npm on startup; in this case no need to mess around with detecting what packages need to be installed, just Npm.install([]) unconditionally every time. Makes startup slower though