3 ms·
Because npm install has the insane default behavior of adding a fuzzy qualifier to your package.json, for example ^6.0.2 means all of the following versions are
by bspammer 5y ago
Because npm install has the insane default behavior of adding a fuzzy qualifier to your package.json, for example ^6.0.2 means all of the following versions are accepted: 6.0.2, 6.0.9, 6.7.84
- samhh 5y agoThat's not an issue, that assists in quickly viewing wanted package upgrades. The problem is in not using a lockfile.
- K0nserv 5y agoIt’s not particularly insane. package.json and package-lock.json have different purposes, namely package.json specified intent e.g. I want a version that satisfies >=5.2.3 && < 6.0.0 and package-lock.json records the exact resolved version. Off the top of my head Bundler, CocoaPods, Cargo, SPM, Pipfile(and various other Python dependency managers), and composer also all work like this. Cargo even makes it implicit that a version like “1” means “^1.0.0” in Cargo.toml.
- jbverschoor 5y agoWelcome to JavaScript, where every division is a bad one