Search for a command to run...
Full Stack Developer | Freelancer | JavaScript | React | Nodejs.
Loves sharing knowledge through technical articles.
Dev.to: https://dev.to/myogeshchavan97
https://linktr.ee/myogeshchavan97
This is a great article!! Thanks Yogesh Chavan. I have two questions
Vulnerable dependencies can lead to real-world exploits such as:
By running audits, you're proactively reducing the risk of these issues in your application.
You should at-least fix the high severity vulnerabilities.
So If your current Node.js version is 17, you should read all the changelog of version 18, 10 and 20 If you want to update to 20 to see if there is any breaking change, and gradually update your project version to 18 first, then 19 and then 20 to see if anything breaks.
You can use https://github.com/nvm-sh/nvm to update node.js version without manual uninstall and install.
Thank you!! I will try using nvm for managing different versions of node. Yogesh Chavan
Thank you so much Andrew Baisden
Thank you so much Hanu
Glad you found it useful. Thank you Tapas Adhikary
Glad to hear that. Thank you Catalin Pit.
In this tutorial, you will build a Task Management App using Next.js 16 and Prisma 7 from scratch. By creating this app, you will learn: How to set up Prisma 7 with the new Rust-free architecture How to configure a database with Prisma's driver ada...
If you're a React/Next.js developer who diligently updated your packages last week after the critical React2Shell vulnerability (CVE-2025-55182), I have some frustrating news: you need to update again. Security researchers, while probing the patches ...
Is your React app dragging its feet, but you can’t pinpoint the cause? You might think you’re following the best practices, but some common development patterns are actually degrading your app’s performance behind the scenes. In this article, we’ll u...
How to Use Separate SSH Keys for Company and Personal GitHub Accounts Managing multiple GitHub accounts is a common challenge for developers who juggle both personal and professional projects. It becomes even more complex when you want to use differe...
Have you ever built a React app only to realize that users from different countries can't use it effectively because it only supports English? In this tutorial, you'll learn how to build truly global React application using internationalization (i18n...
In this article, we'll explore how you can easily update npm packages used in your application without worrying about breaking the application functionality.
So let's get started.
Semantic versioning is such an important thing that, every developer needs to understand it whether you are a Node, React or Angular developer.
It’s also one of the frequently asked interview questions.
It defines how to manage the dependencies of npm packages that we install.
So let's understand some basics.
When we create any new Node or React project from scratch we execute the following command:
npm init -y
OR
yarn init -y
This will create a basic package.json file where we can manage the dependencies of packages.
Normally, the package.json will look like this.
As you can see, package.json has a specified version property that starts with 1.0.0 for a new project.
Let’s say we install the specific version of the express package using:
npm install express@4.17.1
It will get added to the dependencies section of package.json as:
"dependencies": {
"express": "^4.17.1"
}
Also, you will see that a new package-lock.json file will also be created. It's a very important file that contains the exact version and download URL of the main package and its dependent packages installed.
You should never edit or delete the package-lock.json. It will be updated automatically when packages are installed or removed.
As you have seen, the dependencies mentioned in package.json file is an object with key-value pairs.
The value is a combination of 3 digits separated by the dot operator. Let's say the version is a.b.c.
a in a.b.c) specifies the major version of the package — It means this version has Major code changes and it might contain breaking API changes.b in a.b.c) specifies the minor version which contains minor changes but will not contain breaking API changes.c in a.b.c) specifies the patch version which usually contains bug fixes.If you are creating your own npm packages, you should also follow these version rules.
If there is a major change in the package, increment the 1st digit of the version property in package.json by one while publishing the package to the npm repository.
For minor changes increment the second digit and for bug fixes increment the third digit value by one.
You can also notice that there is a caret symbol (^) just before the version number.
"express": "^3.17.1"
There are two mostly used symbols that have specific meanings. Let’s understand them.
package.json, using npm update command, will update only patch and minor released version. So if your current version is 3.16.1 and there is a minor version released so the package will be updated to 3.17.1. If there is only a patch version released then it will be updated to the latest available patch version like 3.16.3.Note that, If there is a ^ symbol before the version number, the package will never be updated to a major version if you run npm update command.
If you want to installl the major available version you can specify that version using
npm install express@4.17.1
If you want to install the latest available version of the package execute:
npm install express@latest
You can install only those versions which are provided by that npm package (express package in our case).
If you go to the npm repository of the express package HERE, you can see all the versions of the package If you click on the 264 Versions tab. In this case, 264 versions as of today.
package.json, you can execute the npm outdated command
npm list -g --depth=0
npm audit command. If you are on Mac, you may need to add a sudo in front of it like:sudo npm audit
This command will list out all the vulnerable packages, link with more information about the vulnerability, its severity (low, medium or high) and command that need to be executed to fix the vulnerability.
You should run the npm audit command for your project once in a while, to see if there are any vulnerabilities reported recently and fix them whenever required to keep the packages up-to-date for the security of your application.
Check out my recently published Mastering Redux course.
In this course, you will learn:
and then finally we'll build a complete food ordering app from scratch with stripe integration for accepting payments and deploy it to the production.
Want to stay up to date with regular content regarding JavaScript, React, Node.js? Follow me on LinkedIn.
