How do I update a single dependency in package-lock.json, without any side effects?

user_8837402 0
Viewed 5782

I am looking to update the following NPM (v5) dependency in my application from version 1.0.0 to 1.0.1 without any change to my package.json file.

"dependencies": {
  "package": "~1.0.0"
},

My current package-lock.json file references the dependency as version 1.0.0, so as expected, running npm install installs version 1.0.0 of the package.

The issue lies when running either npm install package@1.0.1 or npm update package where both commands seem to change how the package version reference in package.json

Is there a single command I can run to achieve a minor version update to only the package-lock.json file?

Thanks in advance!

npm frontend node.js javascript
2 Answers

Run npm update <package>.

This will update it to the latest version that satisfies the requirements specified in your package.json and reflect the update in the package-lock.json.

user_20279610

package-lock.json is generated by npm and it's difficult to modify without npm since it contains package hashes.

If you're only referencing modules using the patch version (~1.0.0) I think it's safe to do the following:

  • Backup package.json and delete it
  • Run npm update package. This will use package-lock.json as a reference and will also update package-lock.json
  • Restore package.json
  • Running npm update package now will not update package.json since package-lock.json is the newer version

If you're looking for a one line command:

mv package.json package.json.tmp && npm update package && mv package.json.tmp package.json

Again, this is safe to do only when dealing with patch versions (~1.0.0). If you specify minor (^1.0.0) or major (1.0.0) versions you may want to update package.json directly.

user_8650380
Related