npm loads a version of a package (angularfire2) different from the one specified in package.json - npm

Question

I am trying to create a new development environment for an app using angularfire2 package, downloading the source code from a repository.
The package.json file points to version 2.0.0-beta.6 of angularfire2, as in the following snippet
{
"name": "blah blah",
"author": "blah blah",
...
"dependencies": {
....
"angularfire2": "^2.0.0-beta.6",
...
}
.....
}
I run npm install to download all the packages I need.
Unfortunately, in case of angularfire2, what gets downloaded seems to be a different version of the package (probably 2.0.0-beta.8) which has several breaking changes with respect to version 2.0.0-beta.6.
How is this possible?
The package.json file within the angularfire2 directory (under node_modules) is the following
{
"_args": [
[
{
"raw": "angularfire2#^2.0.0-beta.6",
"scope": null,
"escapedName": "angularfire2",
"name": "angularfire2",
"rawSpec": "^2.0.0-beta.6",
"spec": ">=2.0.0-beta.6 <3.0.0",
"type": "range"
},
"/Users/penrico/ThoughWorks/code/angular/castella"
]
],
"_from": "angularfire2#>=2.0.0-beta.6 <3.0.0",
"_id": "angularfire2#2.0.0-beta.8",
"_inCache": true,
"_location": "/angularfire2",
"_nodeVersion": "6.9.1",
"_npmOperationalInternal": {
"host": "packages-18-east.internal.npmjs.com",
"tmp": "tmp/angularfire2-2.0.0-beta.8.tgz_1487250058126_0.7350442344322801"
},
"_npmUser": {
"name": "davideast",
"email": "dceast#gmail.com"
},
"_npmVersion": "3.10.8",
"_phantomChildren": {},
"_requested": {
"raw": "angularfire2#^2.0.0-beta.6",
"scope": null,
"escapedName": "angularfire2",
"name": "angularfire2",
"rawSpec": "^2.0.0-beta.6",
"spec": ">=2.0.0-beta.6 <3.0.0",
"type": "range"
},
"_requiredBy": [
"/"
],
"_resolved": "https://registry.npmjs.org/angularfire2/-/angularfire2-2.0.0-beta.8.tgz",
"_shasum": "8ec172ff17448c3ccdb79e9c6179da556ff05e1b",
"_shrinkwrap": null,
"_spec": "angularfire2#^2.0.0-beta.6",
"_where": "/Users/penrico/ThoughWorks/code/angular/castella",
"author": {
"name": "jeffbcross,davideast"
},
"bugs": {
"url": "https://github.com/angular/angularfire2/issues"
},
"dependencies": {},
"description": "<p align=\"center\"> <h1 align=\"center\">AngularFire2</h1> <p align=\"center\">The official library for Firebase and Angular 2</p> </p>",
"devDependencies": {
"#angular/compiler-cli": "^2.0.0",
"#angular/platform-server": "^2.0.0-rc.5",
"#types/jasmine": "^2.5.36",
"#types/request": "0.0.30",
"concurrently": "^2.2.0",
"conventional-changelog-cli": "^1.2.0",
"es6-module-loader": "^0.17.10",
"es6-shim": "^0.35.0",
"gulp": "^3.9.0",
"gulp-jasmine": "^2.2.1",
"gulp-typescript": "^2.10.0",
"http-server": "^0.8.5",
"jasmine": "^2.4.1",
"jasmine-core": "^2.4.1",
"json": "^9.0.3",
"karma": "^0.13.19",
"karma-chrome-launcher": "^0.2.2",
"karma-firefox-launcher": "^0.1.7",
"karma-jasmine": "^0.3.6",
"karma-mocha-reporter": "^2.0.2",
"karma-systemjs": "^0.10.0",
"ncp": "^2.0.0",
"parse5": "^1.3.2",
"protractor": "3.0.0",
"reflect-metadata": "0.1.2",
"rimraf": "^2.5.4",
"rollup": "^0.35.11",
"rollup-watch": "^2.5.0",
"systemjs": "^0.19.16",
"systemjs-builder": "^0.15.7",
"traceur": "0.0.96",
"typedoc": "github:jeffbcross/typedoc",
"typescript": "^2.0.2",
"zone.js": "^0.7.2"
},
"directories": {},
"dist": {
"shasum": "8ec172ff17448c3ccdb79e9c6179da556ff05e1b",
"tarball": "https://registry.npmjs.org/angularfire2/-/angularfire2-2.0.0-beta.8.tgz"
},
"homepage": "https://github.com/angular/angularfire2#readme",
"keywords": [
"angular2",
"angular",
"firebase"
],
"license": "MIT",
"main": "bundles/angularfire2.umd.js",
"maintainers": [
{
"name": "angularcore",
"email": "angular-core+npm#google.com"
},
{
"name": "davideast",
"email": "dceast#gmail.com"
},
{
"name": "jeffbcross",
"email": "middlefloor#gmail.com"
}
],
"module": "index.js",
"name": "angularfire2",
"optionalDependencies": {},
"peerDependencies": {
"#angular/common": "^2.0.0",
"#angular/compiler": "^2.0.0",
"#angular/core": "^2.0.0",
"#angular/platform-browser": "^2.0.0",
"#angular/platform-browser-dynamic": "^2.0.0",
"firebase": "^3.0.0",
"rxjs": "^5.0.1"
},
"readme": "ERROR: No README data found!",
"repository": {
"type": "git",
"url": "git+https://github.com/angular/angularfire2.git"
},
"scripts": {},
"typings": "index.d.ts",
"version": "2.0.0-beta.8"
}
The first breaking change (just to make an example that sustains my theory that this is a different version of the package) is that there is no more FirebaseAuth (which seems to be substituted by AngularFireAuth).

Answer 1

It's installing a later version, as that version satisfies the caret range you have specified in the package.json file:
"angularfire2": "^2.0.0-beta.6"
If you want a specific version, remove the caret:
"angularfire2": "2.0.0-beta.6"
Looking at the spec - under that NPM has filled out under _requested in the package.json file that's in node_modules/angularfire2 - you can see that caret range you have specified is equivalent to:
"spec": ">=2.0.0-beta.6 <3.0.0",