+ 2 packages from 4 contributors and audited 2 packages in 1.269sĮverything looks fine in my machine, so I commit the change: $ git add mycode.js package.jsonĭid you see my mistake? That’s right: I forgot to add the lockfile into the commit. Suppose I install a new dependency in my Node project: $ npm install -s axios See what happens when the package-lock.json and package.json are not in sync. The thing is that the install algorithm can be too clever sometimes. And it shows, npm is one of my favorite tools and one reason I love working with Node. If we look closely, npm install has been designed with developer convenience in mind. npm will use package-lock.json to make sure it downloads the same files as it did the first time, even if newer compatible versions were released since. The next time we run npm install, the package manager will compare it with the contents of node_modules, the folder that contains every JavaScript module for the current project, and install any missing modules. The key to reproducibility lies in the lockfile, package-lock.json. Adds the module name and version to package.json.This file is called the lockfile, and it lists the URL and checksum of every module installed. Updates (or creates) package-lock.json.

Downloads and installs the module and its dependencies.The typical install invocation is: $ npm install -s MODULE_NAME Its primary function is to install JavaScript modules from the Node official repository. npm is a command-line utility that ships with Node.js. What Is npm?Įvery developer who has worked with anything related to the web has used or heard about Node Package Manager: npm. Less famous than its sibling, npm install, with npm clean-install ( npm ci for short), your CI/CD process becomes more robust.

How to use npm