3 ms·
The little `^` in version numbers in NPM's `package.json` file is such a bizarre choice. The fact that it by default installs all new dependencies with that mea
by TranquilMarmot 5y ago
The little `^` in version numbers in NPM's `package.json` file is such a bizarre choice. The fact that it by default installs all new dependencies with that means that builds on different machines at different times could result in _completely_ different artifacts.
- seattle_spring 5y agoYou should always commit a lockfile (either npm's or yarn.lock) alongside package.json
- TranquilMarmot 5y agoThis helps with CI and deploys, but on developer machines running `npm i` will install different things at different times. The amount of churn a `package-lock.json` file undergoes when all of the dependencies have a `^` is crazy.
- realityking 5y agoWhen you have a package-lock.json file npm i will not upgrade packages. You have to do that manually. The biggest churn in package-lock.json files is from using different npm versions. It’s worth keeping them aligned within a dev team.
- junon 5y agoI use an .npmrc in all of my repos that turns this off. It doesn't help nested dependencies but at least it reduces some of the headache.
- Bolkan 5y agoCan you share it?
- junon 5y agoSure, save this to `.npmrc` right next to your `package.json`. It doesn't retroactively change versions, so any existing ~ or ^ ranges need to have those characters removed. But further `npm i` invocations will save the versions without range characters. save-exact = true package-lock = false update-notifier = false