npm dependency management best practices

Question

I'm a relative newcomer to the node community. I recently got on board so that I could put together a build for a complex web application that's been under development for several years. The two key tools in my build are Grunt and Browserify, but the application uses jQuery, Backbone, d3 and a smattering of other libraries and plugins as well.

A problem that I've been running into is this: by default, when I install and save a package with npm, it sets up the package with a semver expression that captures all future releases of the package whenever you run npm update. Like this article explains well, that may seem like a good thing at first ("give me this package and all future upgrades"), but it exposes your own application to any non-backwards compatible updates the package maintainer makes... The article also provides some recommended best practices, but it was written almost 4 years ago to the day; I'm hoping there are other, newer ideas.

What sort of solutions do you use to resolve this issue? I can't keep wasting time updating my software every time a breaking change is made in a library I rely on. I want to update when I am good and ready, not whenever I run npm update.

so why can't you just set the specific (1) version for each library you need in your package.json? npm respects this. — user2943490
– user2943490, Commented May 22, 2015 at 6:04
That's totally a viable solution, but there are some drawbacks. For one thing it's kind of annoying to manually specify the package version. For another, it may not be the case that I only want a particular version-- maybe I want some upgrades, just not backwards-incompatible ones. npm does offer support for that with its ^ and ~ prefixes, too, which I should've read about before posting. What I've learned from this is that package maintainers can' be trusted with determining the backwards-compatibility of their work, so ^ is questionable in a production environment. — mtoor
– mtoor, Commented May 22, 2015 at 17:09

Miguel · Accepted Answer · 2015-05-22 06:09:47Z

3

Use npm shrinkwrap to save the tree of dependencies containing the exact versions, so when you npm install it'll use those exact versions.

The npm outdated command will tell you what packages are outdated.

Instead of npm update which updates all your packages, update specific packages with npm install <pkg>@<version> --save

edited May 22, 2015 at 6:09

answered May 22, 2015 at 5:54

Miguel

20.7k5 gold badges47 silver badges68 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

npm dependency management best practices

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related