防止频繁构建 package-lock.json

Question

I have a package.json file where I have dependencies fixed to a particular version:

I had run npm install few days back and it generated the package-lock.json file. In the package-lock.json file, I can see that the exact version of eslint , ie v8.23.1 , is installed but the sub-dependencies have a caret sign meaning it'll install the latest major/minor versions, eg @eslint/eslintrc= "^1.3.2" :

After pushing my code, when the Jenkins build runs, it fails saying:

This is because a new version of @eslint/eslintrc is available and my package-lock.json has mapping of v1.3.2 . I have two options in mind:

1. Update package-lock.json every time a sub-dependency gets upgraded but I'll have to do it quite frequently.

2. Lock dependencies using overrides field in package.json but this will also have to be updated frequently.

I want to freeze the dependencies (which I already did as seen in package.json ) and also the sub-dependecies, until I decide to update them manually.

What should be done in this case?

My Node version is v16.15.0 and NPM version is v8.5.5.

Answer 1

The issue was with the node version. Earlier env.NODE_VERSION = '16 --lts' was being used. After setting it to v16.15.0, it worked fine. Thanks, @jonrsharpe:)