5 ms·

> Both `npm install` and `npm ci` respect the lock file This is not correct. `npm install` will update your dependencies, not install them, disregarding the pa

> Both `npm install` and `npm ci` respect the lock file This is not correct. `npm install` will update your dependencies, not install them, disregarding the package versions defined in the lock file. It feels like you are not getting the point of having a lock file in the first place. It should be obvious that you can't do an install (which npm calls ci) if you don't have a lock file. The lock file represents your actual dependencies. Package.json should only be used to explicitly update said dependencies.

IsaacSchlueter 8y ago
If you run `npm install` with no arguments, and you have a lockfile, it will make the node_modules folder match the lockfile. Try it. $ json dependencies.esm < package.json ^3.2.5 # package.json would allow any esm 3.x >=3.2.5 $ npm ls esm tap@12.5.3 /Users/isaacs/dev/js/tap └── esm@3.2.5 # currently have 3.2.5 installed $ npm view esm version 3.2.10 # latest version on the registry is 3.2.10 $ npm install audited 590 packages in 1.515s found 0 vulnerabilities # npm install runs the audit, but updates nothing # already matches package-lock.json $ npm ls esm tap@12.5.3 /Users/isaacs/dev/js/tap └── esm@3.2.5 # esm is still 3.2.5 $ rm -rf node_modules/esm/ # remove it from node_modules $ npm i added 1 package from 1 contributor and audited 590 packages in 1.647s found 0 vulnerabilities # it updated one package this time $ npm ls esm tap@12.5.3 /Users/isaacs/dev/js/tap └── esm@3.2.5 # oh look, matches package-lock.json! what do you know. Now, if you do `npm install esm` or some other _explicit choice to pull in a package by name_, then yes, it'll update it, and update the package-lock.json as well. But that's not what we're talking about. I often don't know what I'm talking about in general, but I do usually know what I'm talking about re npm.
deleted 8y ago
[deleted]

IsaacSchlueter 8y ago

If you run `npm install` with no arguments, and you have a lockfile, it will make the node_modules folder match the lockfile. Try it. $ json dependencies.esm < package.json ^3.2.5 # package.json would allow any esm 3.x >=3.2.5 $ npm ls esm tap@12.5.3 /Users/isaacs/dev/js/tap └── esm@3.2.5 # currently have 3.2.5 installed $ npm view esm version 3.2.10 # latest version on the registry is 3.2.10 $ npm install audited 590 packages in 1.515s found 0 vulnerabilities # npm install runs the audit, but updates nothing # already matches package-lock.json $ npm ls esm tap@12.5.3 /Users/isaacs/dev/js/tap └── esm@3.2.5 # esm is still 3.2.5 $ rm -rf node_modules/esm/ # remove it from node_modules $ npm i added 1 package from 1 contributor and audited 590 packages in 1.647s found 0 vulnerabilities # it updated one package this time $ npm ls esm tap@12.5.3 /Users/isaacs/dev/js/tap └── esm@3.2.5 # oh look, matches package-lock.json! what do you know. Now, if you do `npm install esm` or some other _explicit choice to pull in a package by name_, then yes, it'll update it, and update the package-lock.json as well. But that's not what we're talking about. I often don't know what I'm talking about in general, but I do usually know what I'm talking about re npm.

deleted 8y ago

[deleted]