Semantic Versioning 2.0.0
semver.org
semver.org
I really like http://keepachangelog.com as a guideline for writing changelogs.
Pin your dependencies to specific versions, read changelogs and make informed decisions.
Don't rely on someone bumping patch versions correctly to keep your software stable.
I tend to agree with Jeremy Ashkenas on this issue: https://gist.github.com/jashkenas/cbd2b088e20279ae2c8e