Node.js-在本地安装模块时是否需要package.json依赖项？

Question

I know that doing something like this in package.json :

....
...
"dependencies" : {
    "some-node-module" : "*"
}

is a bad idea since you're basically telling node to always update this module to its latest version, even though your code might not be able to handle any other version other than the current one for this particular module.

So I should instead do something like this :

....
...
"dependencies" : {
    "some-node-module" : "3.4.1"
}

Which basically tells node to always use the version of the module that my code was built around.

Question
I have an app which I've first tested locally. The app has now been built, and using the package.json dependencies , npm has installed all of the appropriate node modules locally under my app's root folder (as opposed to globally, in some obscure folder I don't have immediate access to and which is irrelevant to this app - I simply don't like global installations of node modules - I find them to.. "abstract").

Given that all of the node modules are now installed locally isn't the node modules dependencies part in my package.json now redundant ?

I mean, what if something happens and npm is not available or the specific version of a module can't be found?

Isn't it best to be independent of dynamic node module installations and just have everything installed locally the first time without having to use the package.json dependencies ?

Answer 1

npm install & update

"you're basically telling node to always update this module to its latest version"

Packages won't be automatically updated. The only time the "*" will be an issue is when you are installing the project for the first time via npm install or when you manually run an update via npm update .

I personally prefer to pick a specific version of a module rather than use any wildcards, but even then there are some gotchas...which is why npm shrinkwrap exists.

npm shrinkwrap

Next gotcha:

basically tells node to always use the version of the module that my code was built around

Sorta true. Let's say you use version 1.2.3 of your favorite module and package.json reflects that, but in the module itself is a package.json dependency on another module and that uses "*" ...so when you install, the new internal dependency and the wildcard can wind up breaking the module you thought was 'locked down'.

See the gotcha? Hard coding a version controls for the top level versions but does not enforce anything beneath that...and if a module author you depend upon (or a module they depend upon) uses wildcards, you can't be 100% sure things will be copacetic.

To strictly enforce a version, you'll want to use npm shrinkwrap . (The link there to the docs provides more background, which is good to understand if your project uses more than a few very simple modules.)

And now...your question.

You say:

I mean, what if something happens and npm is not available or the specific version of a module can't be found?

Based on the first two parts of this answer, it should now be clear that it doesn't hurt to have the dependencies explicitly listed in the package.json because node isn't checking things every time the app runs. npm uses package.json when specific actions (install, update, etc) are called but even then, it is a manual trigger.

While situations vary, there are very few that I can imagine where omitting dependencies in package.json is a good idea. If you ever wind up having to rebuild the project, you'll be in trouble. If the project is so good you want to share it, you'll be in trouble. Heck, if this is something for work and you want to go on vacation and need to install it on another machine...you'll be in trouble.

So given the fact that after the initial install, dependencies have no negative impact...use --save or add the dependencies to your package.json . Your future self will thank you. :)