3 ms·

npm always trips me up because "npm install" (not adding a package) can change the lock file.

• thunderbong 6y ago
  If I'm not mistaken, this happens only if you don't specify the exact version number that is required to be installed.
  • dasil003 6y ago
    Sure, but then you lose the intentionality signal of an explicit version. Ruby gems works very nicely by not requiring version numbers but always respecting the lockfile unless you explicitly update one or more packages, so when you add a package with no version you get the latest by default, and you can easily do incremental upgrades that respect version dependencies. Later if you need to lock to a specific version you add it (ideally with a comment about why it's locked to that version) and still utilize the automatic dependency version resolution for updates.
• techplex 6y ago
  Use 'npm ci' does a clean install of the versions listed in the package-lock.json file. https://docs.npmjs.com/cli/v6/commands/npm-ci https://docs.npmjs.com/cli/v6/commands/npm-ci