npm, Dependencies & Package Management
Dependency locking, SemVer, package execution, auditing, and package-manager version consistency.
Q73: Why is package-lock.json important?
package-lock.json locks the exact versions of dependencies installed in node_modules, ensuring deterministic installations across environments.
- Guarantees identical dependency trees across environments.
- Prevents accidental breaks from semver updates.
Which command installs exact versions listed in package-lock.json?
Q74: How does Semantic Versioning (SemVer) work in package.json dependencies?
SemVer uses MAJOR.MINOR.PATCH format. Caret (^1.2.3) permits updates that do not modify the left-most non-zero digit. Tilde (~1.2.3) permits patch-level changes.
- Version components: MAJOR (breaking), MINOR (features), PATCH (fixes).
^allows minor/patch updates;~restricts updates to patches.
Which symbol in package.json allows patch updates but blocks minor version bumps?
Q75: What is the difference between npm and npx?
npm is the package manager used to install, update, and manage project dependencies. npx is a package runner tool that executes binaries without requiring global installation.
npmmanages dependency installation and package publishing.npxexecutes binary packages directly without prior global installation.
Which command runs a package CLI tool directly without installing it globally?
Q76: What does `npm audit` do?
npm audit checks configured dependency packages against known vulnerability databases and generates reports describing security risks and remediation paths.
- Scans installed dependencies for security vulnerabilities.
- Generates vulnerability reports and automated fix actions.
Which command attempts to automatically update vulnerable dependencies?
Q77: What is Corepack and how does it alter package manager management in Node.js?
Corepack is an official tool included with Node.js that manages alternative package managers like Yarn and pnpm. Instead of requiring global installations of specific package manager binaries via npm install -g, Corepack automatically identifies, downloads, and invokes the exact package manager version configured in a project's package.json packageManager field, ensuring identical tooling versions across contributor environments.
- Corepack manages package manager toolchains (Yarn, pnpm) without global npm installs.
- Ensures team consistency by enforcing the exact package manager version declared in
package.json.
Which field in package.json does Corepack read to determine which package manager binary version to execute?