Semantic Versioning and Lockfiles
Packages commonly follow semantic versioning using the MAJOR.MINOR.PATCH format. A major version can contain breaking changes, a minor version generally adds backward-compatible functionality, and a patch version usually contains backward-compatible fixes.
Lockfiles such as package-lock.json record the exact dependency tree installed for a project. This improves reproducibility between environments.
Do Not Ignore Lockfiles
For applications, commit your lockfile so CI and production installations can reproduce the dependency tree.
Dependency Installation Strategies
npm install
npm ci
npm install express@latest
npm outdated💡
npm install installs dependencies and may update the lockfile. npm ci performs a clean, lockfile-based installation and is preferred for CI environments.Key Takeaways
- Semantic versioning communicates compatibility expectations.
- Lockfiles make dependency installations reproducible.
- Use
npm cifor deterministic CI installations.
Knowledge Check
Which command is generally preferred for a clean CI installation?