[BUG] npm update does not retain specified dependency ranges in package.json #7889

Activity

1. rosstroha

   added

   Bugthing that needs fixingthing that needs fixing

   Needs Triageneeds review for next stepsneeds review for next steps

   on Oct 31, 2024
2. v-kchindam-infy commented on Nov 1, 2024

   

   v-kchindam-infy

   on Nov 1, 2024

   Last edited by v-kchindam-infy

   More actions

   @rosstroha I checked with npm update and it does not remove the version range. npm update intended to update the package to the latest version allowed by the version range in the package.json.

   Note: save-exact = true config in your .npmrc you can try removing that from npmrc or you can use inline config while running command like this npm update emoji-poop --no-save-exact
   checkout this config documentation. https://docs.npmjs.com/cli/v8/using-npm/config#save-exact
3. rosstroha commented on Nov 5, 2024

   

   rosstroha

   on Nov 5, 2024

   Author

   More actions

   Same issue
   
4. v-kchindam-infy commented on Nov 6, 2024

   

   v-kchindam-infy

   on Nov 6, 2024

   More actions

   Not an issue, it is working as intended.
5. v-kchindam-infy

   closed this as completedon Nov 6, 2024
6. rosstroha commented on Nov 6, 2024

   

   rosstroha

   on Nov 6, 2024

   Author

   More actions

   Not an issue, it is working as intended.

   I must be missing something. --no-save-exact should retain the dependency range, correct?
7. rosstroha commented on Nov 6, 2024

   

   rosstroha

   on Nov 6, 2024

   Last edited by rosstroha

   Author

   More actions

   Additionally I've removed save-exact=true from my .npmrc file, just to ensure it's not being considered

   Here's my full config

   ; "default" config from default values
   
   _auth = (protected)
   access = null
   all = false
   allow-same-version = false
   also = null
   audit = true
   audit-level = null
   auth-type = "web"
   before = null
   bin-links = true
   browser = null
   ca = null
   cache = "/Users/r.troha/.npm"
   cache-max = null
   cache-min = 0
   cafile = null
   call = ""
   cert = null
   cidr = null
   color = true
   commit-hooks = true
   cpu = null
   depth = null
   description = true
   dev = false
   diff = []
   diff-dst-prefix = "b/"
   diff-ignore-all-space = false
   diff-name-only = false
   diff-no-prefix = false
   diff-src-prefix = "a/"
   diff-text = false
   diff-unified = 3
   dry-run = false
   editor = "vi"
   engine-strict = false
   expect-result-count = null
   expect-results = null
   fetch-retries = 2
   fetch-retry-factor = 10
   fetch-retry-maxtimeout = 60000
   fetch-retry-mintimeout = 10000
   fetch-timeout = 300000
   force = false
   foreground-scripts = false
   format-package-lock = true
   fund = true
   git = "git"
   git-tag-version = true
   global = false
   global-style = false
   globalconfig = "/Users/r.troha/.volta/tools/image/node/20.11.1/etc/npmrc"
   heading = "npm"
   https-proxy = null
   if-present = false
   ignore-scripts = false
   include = []
   include-staged = false
   include-workspace-root = false
   init-author-email = ""
   init-author-name = ""
   init-author-url = ""
   init-license = "ISC"
   init-module = "/Users/r.troha/.npm-init.js"
   init-version = "1.0.0"
   init.author.email = ""
   init.author.name = ""
   init.author.url = ""
   init.license = "ISC"
   init.module = "/Users/r.troha/.npm-init.js"
   init.version = "1.0.0"
   install-links = false
   install-strategy = "hoisted"
   json = false
   key = null
   legacy-bundling = false
   legacy-peer-deps = false
   libc = null
   link = false
   local-address = null
   location = "user"
   lockfile-version = null
   loglevel = "notice"
   logs-dir = null
   logs-max = 10
   ; long = false ; overridden by cli
   maxsockets = 15
   message = "%s"
   node-options = null
   noproxy = [""]
   npm-version = "10.9.0"
   offline = false
   omit = []
   omit-lockfile-registry-resolved = false
   only = null
   optional = null
   os = null
   otp = null
   pack-destination = "."
   package = []
   ; package-lock = true ; overridden by user
   package-lock-only = false
   parseable = false
   prefer-dedupe = false
   prefer-offline = false
   prefer-online = false
   prefix = "/Users/r.troha/.volta/tools/image/node/20.11.1"
   preid = ""
   production = null
   progress = true
   provenance = false
   provenance-file = null
   proxy = null
   read-only = false
   rebuild-bundle = true
   registry = "https://registry.npmjs.org/"
   replace-registry-host = "npmjs"
   save = true
   save-bundle = false
   save-dev = false
   save-exact = false
   save-optional = false
   save-peer = false
   ; save-prefix = "^" ; overridden by user
   save-prod = false
   sbom-format = null
   sbom-type = "library"
   scope = ""
   script-shell = null
   searchexclude = ""
   searchlimit = 20
   searchopts = ""
   searchstaleness = 900
   shell = "/bin/zsh"
   shrinkwrap = true
   sign-git-commit = false
   sign-git-tag = false
   strict-peer-deps = false
   strict-ssl = true
   tag = "latest"
   tag-version-prefix = "v"
   timing = false
   umask = 0
   unicode = true
   update-notifier = true
   usage = false
   user-agent = "npm/{npm-version} node/{node-version} {platform} {arch} workspaces/{workspaces} {ci}"
   userconfig = "/Users/r.troha/.npmrc"
   version = false
   versions = false
   viewer = "man"
   which = null
   workspace = []
   workspaces = null
   workspaces-update = true
   yes = null
   
   ; "user" config from /Users/r.troha/.npmrc
   
   <redacted>
   package-lock = true
   save-prefix = ""
   
   ; "env" config from environment
   
   python = "/opt/homebrew/python/bin/python3.8"
   
   ; "cli" config from command line options
   
   long = true
   
8. rosstroha commented on Nov 8, 2024

   

   rosstroha

   on Nov 8, 2024

   Author

   More actions

   @kchindam-infy
9. ljharb commented on Nov 8, 2024

   

   ljharb

   on Nov 8, 2024

   Contributor

   More actions

   I think this is related to npm/rfcs#547.