npm packages, semver ranges and lockfiles
Where npm saves a package (dependencies, devDependencies, --no-save, -g), what the caret, tilde and exact ranges let npm install, why package-lock.json is committed and npm ci used in CI, how npx and npm scripts reach local binaries, and what causes 'Cannot find module' in production.
Given a scenario and requirements, distinguish which Node.Js Package Management solution is the most fitting.
~6 min read · 6 practice questions ·
What the exam expects
- Choose the
npm installflag that records a package in the right place:dependencies,devDependencies, nowhere (--no-save) or globally (-g). - Work out which published version a caret (
^), tilde (~), exact or open (>=) range lets npm install. - Explain why package-lock.json is committed and why CI should run
npm ci. - Run a locally installed CLI tool with
npxor an npm script. - Diagnose
Cannot find modulein production, and place npm next to its alternatives Yarn and pnpm.
Key terms: dependencies (packages required by your application in production); devDependencies (packages only needed for local development and testing); semver range (a version descriptor such as ^1.4.2 that npm resolves to a concrete version); package-lock.json (the record of the exact dependency tree that was installed); npm ci (a clean, frozen install for automated environments).
Key facts
- Detail
dependencies(-P, --save-prodis the default)
-D, --save-dev- Detail
- Saves to
devDependencies
--no-save- Detail
- Prevents saving to package.json
- Detail
save-prefixdefaults to"^"
- Detail
1.0,1.0.xor~1.0.4
- Detail
1,1.xor^1.0.4
- Detail
- Exact generated tree; intended to be committed
npm ci mismatch- Detail
- Exits with an error; never writes package.json or the lock
NODE_ENV=production- Detail
devDependenciesare not installed
npm run PATH- Detail
- Adds
node_modules/.bin
Sources for this section (6)
- Why does a package installed with `--save-dev` disappear in a container that sets `NODE_ENV=production`?
- When should a pipeline run `npm ci` instead of `npm install`?
- Which range accepts 1.0.5 but not 1.1.0 when starting from 1.0.4?
- How can a script call a locally installed binary such as `eslint` by name?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the JavaScript Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 24 lessons of the JavaScript Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (6 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams