Change in npm install behaviour overwrites github modules in package.json

Question

I have some private development github modules as part of my node.js project. My package.json includes something like:

  "dependencies": {
    ...
    "my-dev-module": "git+ssh://git@github.com/my-company/my-dev-module.git#test-branch",
    ...
  }

For the last few years, when I do npm install my-dev-module it has simply installed that branch and not touched the package.json.

Recently, after install it has started overwriting the entry with:

  "dependencies": {
    ...
    "my-dev-module": "*",
    ...
  }

So on subsequent npm installs it fails because it's not a published module.

This has to do with updating npm to the latest version (7.5.4). I've downgraded npm to 6.14.11 and the problem goes away.

I've read through the recent release documentation, but nothing has appeared obvious as the culprit. Any ideas?

Answer 1

You have your package-lock.json file so use

npm ci

command instead of

npm i

to install the packages.

It will make sure that all packages installed are in according to package-lock.json file and will not edit the version of packages for package.json file. Also It will be a faster query using caching for subsequent command calls.