When I update my deps with yarn upgrage-interactive, it does update in yarn.lock file (and node_module ofc), but package.json still without updates.
How can I update my package.json deps accordingly to latest upgrade packages, which in yarn.lock file?
And how is correct to make updates, so it will affect both yarn.lock n package.json files?
Here's a good tool to do that. Run it, then run yarn and all of your packages will be at their latest versions, updated in the package.json as well.
Be careful, though, as going through a process like this might break your app, especially if it's a major version update (or even a minor one), so the responsibility is still on you. If this concerns you, updating versions manually would be the best bet. If you're using VSCode, it gives intellisense for packages and package versions in package.json, which helps a lot.
Related
I am trying to demystify this NPM behavior. I have a custom library which I create for an Angular Project. The library is copied directly to the Node modules directory in my Angular Folder to test any new functionalities that I add on whatever project is using it. However, I notice the older version of the library is being used by the project.
I wonder whether this is due to the NPM Cache.
So my question is, how does the NPM cache and Node_Modules folder work hand in hand?
I can't directly answer as to how the cache relates to node_modules, but I can say that your package-lock.json file is likely the culprit behind your outdated packages. Try running npm update. If that doesn't work, try deleting your package-lock.json file and running npm install.
If that also doesn't work, make sure you have the correct version specified for your library in your project's package.json file. latest will grab the latest release available, ^1.0.0 will grab the latest minor and patch releases, ~1.0.0 will grab only the latest patch releases, and 1.0.0 will only grab that exact version.
I've got a NPM project which have some dependencies declared within its package.json.
In the meantime this project has grown quite old so I wondering how to update the packages to a newer version. But after installing the packages in the latest version, the output of the npm audit will still show a lot of critical entries. I've found out that the critical part are not the packages mentioned within my package.json but sub-dependencies. For example by installing package X, my project will inevitably also take risks, since package X itself is dependent on the outdated package Y.
How should I handle this?
As title indicates, I'm working on a project where different members have used different tools (NPM and Yarn) for handling packages and modules etc.
We aim to transition to use ONLY Yarn (not our decision). Would anyone be able to share resources detailing how to accomplish such a thing? Or help quickly walk me through the steps?
I tried googling for answers but every single result is yet another article explaining why you should ditch NPM/Yarn and move your project to Yarn/NPM, without explaining the steps one would need to take to move from using both to just one mid-project. Thanks!
It looks like Yarn has a page talking about how to migrate to it from NPM:
https://yarnpkg.com/lang/en/docs/migrating-from-npm/
In most cases, running yarn or yarn add for the first time will just work. In some cases, the information in a package.json file is not explicit enough to eliminate dependencies, and the deterministic way that Yarn chooses dependencies will run into dependency conflicts. This is especially likely to happen in larger projects where sometimes npm install does not work and developers are frequently removing node_modules and rebuilding from scratch. If this happens, try using npm to make the versions of dependencies more explicit, before converting to Yarn.
As of Yarn 1.7.0, you can import your package-lock.json state, generated by npm to Yarn, by using yarn import.
They use many of the same files and structures. The important thing is to check-in the yarn.lock file and make sure everyone is installing using Yarn instead of NPM.
If you have a build server, you could probably use it to enforce those dependencies, but it would be more work.
While using npm I've not once encountered a problem when some package somewhere deep in the dependency tree receives minor or even patch update, but actually introduces a breaking change. Finding the culprit package is not always easy. And the problem most of the time hits CI the hardest as it often performs clean npm install. So all that remains is waiting a day or two till package authors notice and fix the error.
Using exact versions in package.json doesn't help either as referenced packages have dependencies of their own and they are not always specified with exact versions.
Such breaking changes are a fact of life I suppose, as no one is immune to mistakes, and shear number of packages directly and indirectly used in any bigger than trivial project is huge.
So, how to prevent such inevitable breaking changes from disrupting development process?
The only thing I've been able to imagine is a hypothetical feature of npm that would only allow installing packages no younger than now().addDays(-2).
A package-lock.json (npm5) or a npm-shrinkwrap.json (npm 2-4) if created and committed to source control will lock in all of your dependencies and their dependencies so that the exact same versions will be installed. package-lock.json is now generated automatically, and npm-shrinkwrap.json can be created with npm shrinkwrap command. Once these files are created, they will be automatically updated on subsequent npm install --save ... commands.
After updating my NPM to the latest version (from 3.X to 5.2.0) and running npm install on an existing project, I get an auto-created package-lock.json file.
I can tell package-lock.json gives me an exact dependency tree as opposed to package.json.
From that info alone, it seems like package.json is redundant and not needed anymore.
Are both of them necessary for NPM to work?
Is it safe or possible to use only the package-lock.json file?
The docs on package-lock.json (doc1, doc2) doesn't mention anything about that.
Edit:
After some more thinking about it, I came to the conclusion that if someone wants to use your project with an older version of NPM (before 5.x) it would still install all of the dependencies, but with less accurate versions (patch versions)
Do you need both package-lock.json and package.json? No.
Do you need the package.json? Yes.
Can you have a project with only the package-lock.json? No.
The package.json is used for more than dependencies - like defining project properties, description, author & license information, scripts, etc. The package-lock.json is solely used to lock dependencies to a specific version number.
package-lock.json: records the exact version of each installed package which allows you to re-install them. Future installs will be able to build an identical dependency tree.
package.json: records the minimum version you app needs. If you update the versions of a particular package, the change is not going to be reflected here.
If your question is if lock file should be committed to your source control - it should. It will be ignored under certain circumstance.
I found it bloating pull requests and commit history, so if you see it change, do a separate commit for it.