A dependency is declared as "some-lib": "^0.2.3". Which version can npm install?

npm can install 0.2.9. The caret (^) allows any update that keeps the leftmost non-zero digit the same. In 0.2.3, that digit is the minor number 2. So the range is >=0.2.3 <0.3.0, and only patch updates are allowed.

Many people pick "0.3.0", because ^1.2.3 does match 1.3.0. But in 0.x versions, npm treats a minor bump as a breaking change, so "0.3.0" is outside the range.