NPM install behaves differently in different situation, unable to understand if it's correct or not? - Javascript

null2493
April 23, 2023
192 views
1 vote
2 Answers

npm init to initialize the project
I am using axios: "~1.2.4" in the package.json file
- when I run npm install package 1.2.6 will be installed which is correct as the latest patch will be installed
- now if I use ^1.2.4 in package.json and run npm install the node modules or package-lock.json won’t get updated to 1.3.6 which is the intended behaviour based on the usage of ^ (why is this happening here?)
- now if I use ^1.3.4 in package.json and run npm install the node modules and package-lock.json both will get updated to use 1.3.6 which is the intended behaviour (and I suppose this is correct)
- now if I use 1.2.4 or 1.3.4 the packages with the version will be installed

Also, what is the actual use of the .package-lock.json file?

Update: https://medium.com/helpshift-engineering/package-lock-json-the-complete-guide-2ae40175ebdd#:~:text=different%20machines%2Fenvironments.-,package%2Dlock.,json%20file. This article helps to answer my question and you can also read ray’s answer which is also helpful.

Answers

- AhmedNefzaoui
- April 23, 2023 at 7:54 am
- 0 votes
0
Let’s say you have the following package.json file:
```
{
  "name": "my-project",
  "version": "1.0.0",
  "dependencies": {
    "axios": "~1.2.4"
  }
}
```
When you run npm install, NPM will install the latest patch of the 1.2.x range, which in this case is 1.2.6. This is because you used the ~ symbol in your package.json file, which specifies that the latest patch version in the 1.2.x range should be used.

Now, let’s say you update your package.json file to:
```
{
  "name": "my-project",
  "version": "1.0.0",
  "dependencies": {
    "axios": "^1.2.4"
  }
}
```
When you run npm install, NPM will install the latest minor version of the 1.x.x range that is backward compatible with the specified version, which in this case is 1.3.6. This is because you used the ^ symbol in your package.json file, which specifies that the latest minor version in the 1.x.x range should be used.

Finally, let’s say you update your package.json file to:
```
{
  "name": "my-project",
  "version": "1.0.0",
  "dependencies": {
    "axios": "1.2.4"
  }
}
```
When you run npm install, NPM will install the exact version specified, which in this case is 1.2.4.

Regarding the .package-lock.json file, here’s an example of what it looks like:
```
{
  "name": "my-project",
  "lockfileVersion": 1,
  "requires": true,
  "dependencies": {
    "axios": {
      "version": "1.2.4",
      "resolved": "https://registry.npmjs.org/axios/-/axios-1.2.4.tgz",
      "integrity": "sha1-UEyB0s+1ijOHPFr+mZz1xIMXdv8="
    }
  }
}
```
As you can see, the .package-lock.json file specifies the exact version of the axios package that was installed, which ensures consistent builds across different environments.
Login or Signup to reply.

- Ray
- April 24, 2023 at 8:00 am
- 0 votes
0
now if I use ^1.2.4 in package.json and run npm install the node modules or package-lock.json won’t get updated to 1.3.6 which is the intended behaviour based on the usage of ^ (why is this happening here?)

It doesn’t get updated because the package-lock file references the specific version you’ve already installed. This is the purpose of the package-lock file: repeatable installs. If you (or anyone else) installed this on another machine you’d get the same versions of all of your dependencies.

If you delete the package-lock file before running npm install you’ll get the latest version that matches your package.json spec (and package-lock will get recreated).

now if I use ^1.3.4 in package.json and run npm install the node modules and package-lock.json both will get updated to use 1.3.6 which is the intended behaviour (and I suppose this is correct)

This works because the 1.2.x version you already have (the one in your package-lock) doesn’t meet the ^1.3.4 requirement, so npm installs one that does and updates package-lock accordingly.

Login or Signup to reply.