3 ms·
> I want a reproducible, deterministic result of a known state Yes, that's `npm ci`. With a fresh `npm install` you get the latest packages that satisfy depen
by montroser 1y ago
> I want a reproducible, deterministic result of a known state
Yes, that's `npm ci`.
With a fresh `npm install` you get the latest packages that satisfy dependencies in the ranges spec'd in package.json. That's basically a crap shoot because even if you specifically pin the versions of all your dependencies, chances are that at least some of your dependencies did not have the good sense to do the same for their dependencies. This is the path to hell.
With a fresh `npm ci` on the other hand, you get back exactly to the known state specified in package-lock.json, where everything is pinned, all the way down. This is the path to happiness.
- rectang 1y agoDoes anybody disable `npm install`? For yourself? For a team?
- zdragnar 1y agoThe official tutorial at https://nodejs.org/en/learn/getting-started/an-introduction-to-the-npm-package-manager https://nodejs.org/en/learn/getting-started/an-introduction-... says to use `npm install` and makes no mention of `npm ci` at all. Further, the name of the command (though not the clean-install alias) shows that it was tacked on top of a fundamentally broken base. > That's basically a crap shoot because even if you specifically pin the versions of all your dependencies, chances are that at least some of your dependencies did not have the good sense to do the same for their dependencies. As I mentioned in my first comment, I don't really want my dependencies to pin their dependencies. I want them to specify a range they work with to minimize the number of redundant copies of common transitive dependencies.