package.json docs: https://docs.npmjs.com/cli/v8/configuring-npm/package-json
Running cross-platform tasks via npm package scripts: https://2ality.com/2022/08/npm-package-scripts.html -> Outdated! New link is https://exploringjs.com/nodejs-shell-scripting/ch_package-scripts.html, so it's a chapter of the book Shell scripting with Node.js
npm <-> yarn:
npm run lists all the executable commands/scripts.
Upgrade npm itself:
npm install npm@latest -g
(If this command fails and we then get
zsh: command not found: npm we can fix it with
brew reinstall node.)
List all commands:
npm. List commands with details:
Install to devDependencies:
npm install --save-dev webpack or
npm i -D webpack
Suppress output like '204 packages are looking for funding' or '8 high severity vulnerabilities':
npm i --no-audit --no-fund --no-optional
npm list or
npm list --depth=0
List all outdated packages:
Also see: https://github.com/raineorshine/npm-check-updates -
Uninstall a package:
npm uninstall <package>
Show package info:
npm info <package>
Open docs (eg README) in the browser:
npm docs <package>
To pass arguments to a script you need to add
npm run docs). Eg if we have the script
"test": "jest" and we want to run Jest in watch mode, we need to do
npm test -- --watch. Note: in this case doing
npx jest --watch also works.
npx command runs a binary or package. It can be a local package (eg a binary in ./node_modules/.bin/) or fetched remotely. See https://docs.npmjs.com/cli/v8/commands/npx
npm ci (clean install)
- Docs: https://docs.npmjs.com/cli/v8/commands/npm-ci
- Use it when you want to make sure you're doing a clean install of your dependencies
- It's deterministic - it always creates the same
node_modulesor it throws an error
- Uses the exact package versions listed in
package-lock.json. In contrast,
npm installcan install different versions of a package if you use version ranges (
- More info:
Describe a single representation of a dependency tree such that teammates, deployments, and continuous integration are guaranteed to install exactly the same dependencies
Find outdated and unused packages: https://github.com/dylang/npm-check
--forcestill pins many dependency versions which is stricter.
--legacy-peer-depsignores peer dependencies entirely, which can screw up your dependency resolution.
--forceon the other hand simply sets a different peer dependency version for conflicting dependencies.
Update a package
npm i [-D] [-E] somepackage@latest (eg
npm i -D -E typescript@latest) because using
npm update doesn't update
Note that by default
npm updatewill not update the semver values of direct dependencies in your project
package.json, if you want to also update values in
package.jsonyou can run:
npm update --save(or add the
save=trueoption to a configuration file to make that the default behavior).
Init without questions:
npm init -y
Get rid of 'x packages are looking for funding'
npm config set fund false
# check the value, it should be false now
npm config get fund
List global pacakges:
npm list -g --depth=0
List outdated global packages:
npm outdated -g
Add global package:
npm install -g <package>
Update 1 global package:
npm update -g <package>
Update all global packages:
npm update -g
Remove global package:
npm uninstall -g <package>
Putting packages in
devDependencies matters on Node.js and libraries, but not when creating a bundle (eg with Create React App).
How do I decide whether @types/* goes into
devDependencies? - https://stackoverflow.com/questions/45176661/how-do-i-decide-whether-types-goes-into-dependencies-or-devdependencies
create-react-app install devDepencies in dependencies section - https://stackoverflow.com/questions/44868453/create-react-app-install-devdepencies-in-dependencies-section
Consider moving react-scripts to devDependencies in the generated package - https://github.com/facebook/create-react-app/issues/4342
I don't think npm's advice is very relevant here. It is primarily concerning Node apps. CRA doesn't give you a Node app. From that perspective, all dependencies (including React) are "dev" dependencies because they're only necessary for the build: once you build the app, it has no deps at all.
Everything goes into dependencies? - https://github.com/facebook/create-react-app/issues/6180
The distinction is meaningful for Node apps because they actually are deployed as runtime. So you might not want to deploy development dependencies.
In case of CRA, the end result is a static bundle. So in a sense all dependencies are "development dependencies", even React or libraries you use. They're used only at the build time.
semver calculator: https://semver.npmjs.com
"same-major": "^15.7.2", // upgrade to 15.X.Y (eg 15.7.3 and 15.8.0, but not 16.0.0)
"same-major-and-minor": "~15.7.2" // upgrade to 15.7.X
There are more operators you can use in addition to
<1.2.3 || >=4.5.6,
1.0.0 - 1.2.0. See https://semver.npmjs.com and https://medium.com/helpshift-engineering/package-lock-json-the-complete-guide-2ae40175ebdd
To save exact do:
npm install --save-exact express or
npm i -E express
Exact or range versions?
Force exact package versions with a
Find parent of transitive dependency
npm ls @typescript-eslint/typescript-estree
This will print who is using
│ └─┬ @firstname.lastname@example.org
│ └── @email@example.com deduped
Here the transitive dependency
@typescript-eslint/typescript-estree is being imported by the direct dependency
@react-native-community/eslint-config (which appears in package.json).