3 ms·

A specific version of a package is immutable on npm. So if you depend on exactly foo@1.2.3 in your shrinkwrap you'll always get the same code. In other words, e

A specific version of a package is immutable on npm. So if you depend on exactly foo@1.2.3 in your shrinkwrap you'll always get the same code. In other words, even if the package is unpublished, and picked up by a new user they can't re-publish new code to 1.2.3. If you depend on a version range like ^1.2.3 or ~1.2.3 its a different story, of course. Moral of the story is imo always pin to exact versions and use shrinkwrap for production apps. EDIT: This may not be true .. see below.

choward 11y ago
> A specific version of a package is immutable on NPM. That's not true. I thought it was but it's not. That's the terrible part. To demonstrate with one of the packages that was removed, run: $ npm info andthen You'll see that versions 0.0.1 and 0.0.2 were published at one point. However, for "versions" it only mentions 2.0.0. And of course, if you run: $ npm install andthen@0.0.2 It blows up in your face.
- Wintamute 11y ago
  :o