Update Installed npm Packages

Just like any other software component, external packages are often updated with new features, performance improvements, bug fixes, or security patches.

Keeping these packages as up-to-date as possible generally ensures that your project remains healthy, functional, and secure over time.

Semantic versioning

Semantic versioning (SemVer) is a software versioning system used to assign meaningful version numbers to packages, indicating the nature of changes:

MAJOR.MINOR.PATCH

Where:

• MAJOR: Introduces a breaking change, making the new version incompatible with the previous version (e.g., 1.0.0 -> 2.0.0).
• MINOR: Introduces a new feature with backward compatibility (e.g., 1.0.0 -> 1.1.0).
• PATCH: Introduces a bug fix without affecting existing functionality or adding new features (e.g., 1.0.0 -> 1.0.1).

Define version ranges

In npm, semantic versioning allows developers to lock down packages to specific versions or version ranges, which helps avoid unintentionally installing updates that might introduce breaking changes.

To define which versions of a package are acceptable to install, you can use the following expressions:

• version: Requires the exact version specified.
• >version: Accepts any version that is greater than the specified version.
• >=version: Accepts the specified version or any greater version.
• <version: Accepts any version that is less than the specified version.
• <=version: Accepts the specified version or any version lower.
• ~version: Accepts patch version updates, but locks the minor version.
• ^version: Accepts minor and patch version updates, but locks the major version.
• *: Accepts any version.

Example

Let's consider the dependencies of this package.json file:

{
  "dependencies": {
    "axios": "1.4.0",
    "dayjs": "^1.11.9",
    "jsonwebtoken": "~9.0.2"
  }
}

Where:

• The "axios" package at version 1.4.0 is required to remain at version 1.4.0.
• The "dayjs" package at version ^1.11.9 can be updated to version 1.11.10 or 1.12.9, but not 2.11.9.
• The "jsonwebtoken" package at version ~9.0.2 can be updated to version 9.0.3 or 9.0.4, but not 10.0.3 or 9.1.3.

Check outdated dependencies

To see which of your installed packages are outdated, you can use the npm outdated command:

$ npm outdated

This will output their current version, the wanted version that satisfies the version constraints specified in the package.json file, and the latest version available on npm:

$ npm outdated
Package            Current   Wanted   Latest  Location                        Depended by
axios                1.4.0    1.7.7    1.7.7  node_modules/axios              app
dayjs               1.11.9  1.11.13  1.11.13  node_modules/dayjs              app
next               13.4.12  13.4.12  14.2.13  node_modules/next               app
react               18.2.0   18.2.0   18.3.1  node_modules/react              app

Update dependencies

Update to the latest version

To update a dependency to the latest version available on npm, you can use the npm install command with the @latest tag:

$ npm install package@latest

Note: This command will also update the package.json file to reflect the changes.

Update to a specific version

To update a dependency to a specific version, you can use the npm install command with this syntax:

$ npm install package@version

Update minor and patch versions

To update a dependency to the highest possible version based on the version range specified in the package.json file, you can use the npm update command:

$ npm update package

Update all dependencies

To update all dependencies at once based on they version ranges, you can use the npm update command without arguments:

$ npm update

Best practices

1. Read the Changelog: Before updating, especially to a new major version, review the changelog to understand what has changed and whether it could break your project.
2. Test Thoroughly: After updating, run your tests and manually check that everything works as expected.
3. Lock Down Versions: In production environments, consider using an npm lockfile (package-lock.json) to ensure that the exact same versions are installed across environments.
4. Use Version Control: Always commit changes before updating. This way, you can easily roll back if an update causes issues.

Summary

Here's a summary of what you've learned in this lesson:

• Semantic versioning is a software versioning system used to assign meaningful version numbers to packages.
• Semantic versioning allows developers to lock down packages to specific versions or version ranges.
• The npm outdated command is used to check which of your installed packages are outdated.
• The npm install command is used to update a package to a specific version or its latest version.
• The npm update command is used to update a package or all packages to their highest allowed version.