npm — package.json, semver ranges and the lockfile¶
Level: 101 · for anyone who has typed npm install
Stub — an outline, not a lesson. There is no runnable example behind this page yet, so nothing on it has been through the check that backs every other claim in this library. The questions below are what the finished page has to answer.
One line: The caret in "^1.2.3" accepts any 1.x.y from 1.2.3 up, but "^0.2.3" stops before 0.3.0 — below 1.0 the caret locks the minor version — and neither admits a prerelease such as 1.3.0-beta.1; the lockfile records what was actually installed.
Keywords: package.json, package-lock.json, semver, npm ci, npm install
What the finished page will answer¶
- Which versions do
^1.2.3,^0.2.3,^0.0.3and~1.2.3accept, checked with thesemvermodule npm uses? - What do
version,resolvedandintegrityrecord for the repo'stypescriptentry inpackage-lock.json? - What does
npm cido whenpackage.jsonnames a dependency the lockfile lacks, and what doesnpm installdo instead? - What goes in
dependenciesand what indevDependencies, and which doesnpm ci --omit=devskip? - Why does this repo pin
"typescript": "7.0.2"with no caret at all?
Examples it will need¶
-
npm_caret_and_tilde_ranges_sh.sh— true or false for versions against ^1.2.3, ^0.2.3, ^0.0.3 and ~1.2.3, using the semver module inside npm -
npm_ci_refuses_a_stale_lockfile_sh.sh—npm ci --offline's EUSAGE error and exit status 1 when package.json names afile:dependency the lockfile lacks -
npm_lockfile_records_sh.sh— the version, resolved URL and integrity the repo's package-lock.json records for typescript
See also¶
package.json—typeandexports, the fields Node itself readsnpm runandnpx— thescriptsfield, and running whatdevDependenciesinstalled- Types for packages —
@typespackages, and why they are dev dependencies - Rust: Adding a dependency:
search,info,add↗ — the caret in Cargo, which follows the same rule below 1.0 - Rust:
Cargo.lock: what it records, who reads it, and the command that ignores it ↗ — the lockfile in Cargo, and the command that ignores it - Python:
pyproject.toml↗ — the project file in Python