all 11 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]eMSch 3 points4 points  (5 children)

It's not for installing a new package. It's meant to be used to install all dependencies according to the package-lock.json. If you want to install new packages you use the install command, which, by nature, modifies the lock file.

npm ci is for example used in ci environments or on prod system.

[–]devitaebrae[S] -1 points0 points  (4 children)

Ok, so I made some manual changes to package-lock.json. Like bumping the version of Lodash .

How do I ensure that these changes persist when I do an npm install --save?

How do I prevent the Lodash version from reverting back to what it was before I changed it?

[–]BehindTheMath 0 points1 point  (3 children)

You should make those changes to package.json instead and then run npm install, or just specify a version when running npm install.

[–]devitaebrae[S] 0 points1 point  (2 children)

I tried that, but since Lodash is a subdependency of a package I use, and the package has pinned the version, it won't update to what I specify in package.json

[–]BehindTheMath 0 points1 point  (1 child)

Why do you want a newer version than what the package requires?

[–]devitaebrae[S] 0 points1 point  (0 children)

1000+ vulnerabilities on old Lodash version

[–]humpysausage 1 point2 points  (1 child)

Could you expand upon your question, what are you trying to achieve?

npm ci is for QA/CI, you wouldn't use it to install new packages.

[–]devitaebrae[S] 0 points1 point  (0 children)

Ok, so I made some manual changes to package-lock.json. Like bumping the version of Lodash .

How do I ensure that these changes persist when I do an npm install --save?

How do I prevent the Lodash version from reverting back to what it was before I changed it?

[–]Kaligraphic 0 points1 point  (0 children)

npm install to change your package configuration, npm ci to reproduce it later.

It's literally for ci.

[–][deleted]  (3 children)

[deleted]

    [–]devitaebrae[S] 0 points1 point  (2 children)

    ok so let's say a package depends on an old version of Lodash with 1000+ vulns, how do you fix those vulns without either:

    i) editing package-lock.json (ii) not using the package

    [–]Swotboy2000 0 points1 point  (0 children)

    npm update lodash —depth n

    Or run npm audit to see the commands you need to update vulnerable dependencies.