Let’s do a easy verify: open any JS venture that you’ve got at hand and attempt to discover the ^ image within the bundle variations. If you do not have one, congratulations! In any other case, I’ve unhealthy information for you.
“Appropriate” variations
By default NPM saves bundle variations in bundle.json with ^ prefix in entrance of the model quantity.
^model is described as “Appropriate with model” in NPM docs which implies “any minor or patch model equal or greater than specified”.
The issue with such variations is that after eradicating node_modules and package-lock.json and working npm set up some packages could also be upgraded to greater patch or minor variations with out you figuring out it.
This should not break something as a result of often bundle builders observe semantic versioning rule saying that breaking modifications can solely be launched in main model updates.
However in actuality there is no such thing as a assure that new minor model of a bundle would not break one thing in your app. This occurs even for well-tested and well-maintained packages with massive group like Webpack (see subject #8082).
Safety
However there may be additionally a a lot worse downside: safety dangers. Think about {that a} hacker will get entry to the NPM account of the proprietor of some standard bundle. Publishing a patch model with malicious code would instantly make all of the functions utilizing this dependency (and even bundle that is determined by this dependency) susceptible. You’ll be able to simply discover examples of such assaults by googling ‘npm bundle hack’, right here is one among them: DeFi Trade dYdX NPM Consumer Account Will get Hacked
How you can repair the issue
- Add
save-exact=trueto your bundle.json. This may make npm set up particular variations of the packages which might be utilized in your venture. - Take away
^indicators from the bundle variations in bundle.json. Or change this inexact variations with precise variations of put in packages. Yow will discover them in package-lock.json.
However there’s a easier answer: a CLI software known as exactify.
I’ve created it to automate the method of changing “appropriate with” variations with precise variations of put in packages taken from package-lock.json. It additionally provides save-exact=true to your .npmrc file which forces NPM to avoid wasting precise variations for additional bundle installations.
Simply sort npx exactify within the root of your venture and see what occurs!
Thanks for studying
Let me know should you discovered this handy. When you have any strategies, characteristic requests or bug reviews, be at liberty to fill a problem or open a PR on GitHub. Stars are kindly appreciated!
Thanks for studying! Do not forget to hit the like button and depart a remark bellow ✨
