node.js - 有没有办法禁用与 npm 的合理关闭版本匹配？

Question

npm 能够匹配直接和传递依赖的非精确版本。

https://npmjs.org/doc/misc/semver.html

例如，如果您依赖于 v1.2.3 的模块/库，并且您在 package.json 中将此依赖项声明为

"foo": "~1.2.3"

在包含~任何标记foo为.1.3.0-beta

有没有办法禁用这种松散/模糊匹配，以便依赖解析更加一致？

例如，如果存在上述依赖项，则解析的版本将始终为 1.2.3。

最重要的是，这也需要适用于传递依赖。

Answer 1

I think npm shrinkwrap is what you are looking for. Once you have a set of installed dependencies you want to freeze for deployment, run npm shrinkwrap and the entire dependency tree with all versions will be locked into place.

This is a somewhat new feature (Feb 2012, ok not that new) and I haven't seen that much adoption yet, but officially this is the solution to your concerns. Another approach folks take is just never use any wildcards in their dependency versions: "1.2.3", which is mostly sufficient for applications but is frowned upon for reusable modules.

More details about the reasoning behind npm shrinkwrap are in the blog post from when it was announced.

Answer 2

默认情况下，npm 使用 ^ 安装软件包，这意味着同一主要范围内的任何版本，您可以使用 --save-exact 切换此行为。

这仅适用于父依赖项，对于子依赖项，您需要使用 npm shrinkwrap 或 yarn lock 文件。

// npm
npm install --save --save-exact react

// yarn
yarn add --exact react

如果有人在未来寻找这个，我创建了一篇关于保存精确的博客文章。

https://www.dalejefferson.com/blog/how-to-save-exact-npm-package-versions/