Bower resolutions vs default SemVer: which yields a predictable dependency tree?

When a Bower project depends on two packages that request different semver ranges of the same library, the default resolution algorithm may install multiple copies to satisfy each range. The resolutions field in bower.json forces a single version across the entire dependency tree, eliminating duplicates but requiring manual oversight when upstream packages change. The trade-off is between a smaller, more predictable install and the risk of pinning to an outdated release that misses security fixes. For a project that must ship a single version of a shared library, which strategy better balances reproducibility and update velocity? Should the resolution be applied at the top-level manifest or delegated to each package's own declarations? And how do Git URL or local path dependencies interact with the resolutions override?