Both operators mean “this version or a bit newer” and they differ in where the ceiling sits. The difference only shows up when a dependency releases a minor version, at which point one of them upgrades and the other does not.
"^1.2.3" // >=1.2.3 <2.0.0 — minor and patch
"~1.2.3" // >=1.2.3 <1.3.0 — patch only
"~1.2" // >=1.2 <2.0.0 — minor and patch
"1.2.*" // >=1.2 <1.3.0~ is stricter with three components and equivalent to ^ with two, which is exactly the sort of rule that gets misremembered. ^ is the right default because it matches what semantic versioning promises. It also assumes the package actually follows semver — for one that does not, a tighter constraint is not paranoia.