npm check and update package if needed

问题:

We need to integrate Karma test runner into TeamCity and for that I'd like to give sys-engineers small script (powershell or whatever) that would:

1. pick up desired version number from some config file (I guess I can put it as a comment right in the karma.conf.js)

2. check if the defined version of karma runner installed in npm's global repo

3. if it's not, or the installed version is older than desired: pick up and install right version

4. run it: karma start .\Scripts-Tests\karma.conf.js --reporters teamcity --single-run

So my real question is: "how can one check in a script, if desired version of package installed?". Should you do the check, or it's safe to just call npm -g install everytime?

I don't want to always check and install the latest available version, because other config values may become incompatible

回答1:

To check if any module in a project is 'old' you should do:

npm outdated

'outdated' will check every module defined in package.json and see if there is a newer version in the NPM registry.

Here is an example, showing that xml2js (that is in node_modules/ in the current directory) is outdated, because a newer version exists (0.2.7):

xml2js@0.2.7 node_modules/xml2js current=0.2.6

If you want to check for outdated modules and install newer version then you can do: npm update (for all modules) or npm update xml2js (only checks/updates xml2js)

Have a look at the NPM docs:

• https://docs.npmjs.com/cli/outdated
• https://docs.npmjs.com/cli/update

回答2:

npm outdated will identify packages that should be updated, and npm update <package name> can be used to update each package. But npm update <package name> will not update the versions in your package.json which is an issue.

The best workflow is to:

1. Identify out of date packages
2. Update the versions in your package.json
3. Run npm update to install the latest versions of each package

Check out npm-check-updates to help with this workflow.

• Install npm-check-updates
• Run npm-check-updates to list what packages are out of date (basically the same thing as running npm outdated)
• Run npm-check-updates -u to update all the versions in your package.json (this is the magic sauce)
• Run npm update as usual to install the new versions of your packages based on the updated package.json

回答3:

There is also a "fresh" module called npm-check:

npm-check

Check for outdated, incorrect, and unused dependencies.

It also provides a convenient interactive way to update the dependencies.

回答4:

• To update a single local package:

  1. First find out your outdated packages:

     npm outdated

  2. Then update the package or packages that you want manually as:

     npm update --save package_name

This way it is not necessary to update your local package.json file.

Note that this will update your package to the latest version.

• If you write some version in your package.json file and do:

  npm update package_name

  In this case you will get just the next stable version (wanted) regarding the version that you wrote in your package.json file.

And with npm list (package_name) you can find out the current version of your local packages.

回答5:

One easy step:

$ npm i -g npm-check-updates && ncu -a && npm i

That is all. All of the package versions in package.json will be the latest.

Edit:

What is happening here?

1. Installing a package that checks updates for you.

2. Use this package to update all package versions in your package.json (-a is short for --updateAll).

3. Install all of the new versions of the packages.

回答6:

When installing npm packages (both globally or locally) you can define a specific version by using the @version syntax to define a version to be installed.

In other words, doing: npm install -g karma@0.9.2 will ensure that only 0.9.2 is installed and won't reinstall if it already exists.

As a word of a advice, I would suggest avoiding global npm installs wherever you can. Many people don't realize that if a dependency defines a bin file, it gets installed to ./node_modules/.bin/. Often, its very easy to use that local version of an installed module that is defined in your package.json. In fact, npm scripts will add the ./node_modules/.bin onto your path.

As an example, here is a package.json that, when I run npm install && npm test will install the version of karma defined in my package.json, and use that version of karma (installed at node_modules/.bin/karma) when running the test script:

{
 "name": "myApp",
 "main": "app.js",
 "scripts": {
   "test": "karma test/*",
 },
 "dependencies": {...},
 "devDependencies": {
   "karma": "0.9.2"
 }
}

This gives you the benefit of your package.json defining the version of karma to use and not having to keep that config globally on your CI box.

回答7:

Check outdated packages

npm outdated

Check and pick packages to update

npx npm-check -u

npm oudated img

npx npm-check -u img

回答8:

NPM commands to update or fix vulnerabilities in some dependency manifest files

• Use below command to check outdated or vulnerabilities in your node modules.

  npm audit

• If any vulnerabilities found, use below command to fix all issues.

  npm audit fix

• If it doesn't work for you then try

  npm audit fix -f, this command will almost fix all vulnerabilities. Some dependencies or devDependencies are locked in package-lock.json file, so we use -f flag to force update them.

• If you don't want to use force audit fix then you can manually fix your dependencies versions by changing them in package-lock.json and package.json file. Then run `npm update && npm upgrade'

回答9:

npm install -g npm-check-updates

ncu -f your-intended-package-name -u