npm-force-resolutions

What is npm-force-resolutions?

The npm-force-resolutions package allows you to force specific versions of transitive dependencies in your npm project. This can be useful when you need to ensure that a particular version of a dependency is used, regardless of what is specified in the dependency tree.

What are npm-force-resolutions's main functionalities?

Force specific dependency versions

You can specify the exact version of a package that you want to force in your project. This is done by adding a 'resolutions' field in your package.json file. For example, to force version 1.2.3 of 'package-name', you would add the above code to your package.json.

{
  "resolutions": {
    "package-name": "version"
  }
}

Run npm-force-resolutions

After specifying the resolutions in your package.json, you need to run the npm-force-resolutions command to apply these resolutions. This command updates your package-lock.json file to reflect the forced versions.

npx npm-force-resolutions

Other packages similar to npm-force-resolutions

yarn

Yarn is a package manager that also supports dependency resolutions. In Yarn, you can specify resolutions in your package.json file similarly to npm-force-resolutions. However, Yarn is a full-fledged package manager, whereas npm-force-resolutions is a tool specifically for forcing dependency versions.

npm-shrinkwrap

npm-shrinkwrap is a feature of npm that allows you to lock down the versions of your entire dependency tree. While it doesn't allow you to force specific versions of transitive dependencies like npm-force-resolutions, it ensures that the exact versions of all dependencies are used in your project.

README

NPM Force Resolutions

This packages modifies package-lock.json to force the installation of specific version of a transitive dependency (dependency of dependency), similar to yarn's selective dependency resolutions, but without having to migrate to yarn.

WARNING before you start

The use case for this is when there is a security vulnerability and you MUST update a nested dependency otherwise your project would be vulnerable. But this should only be used as a last resource, you should first update your top-level dependencies and file an issue for them to update the vulnerable sub-dependencies (npm ls <vulnerable dependency> can help you with that).

How to use

First add a field resolutions with the dependency version you want to fix to your package.json, for example:

"resolutions": {
  "hoek": "4.2.1"
}

Then add npm-force-resolutions to the preinstall script so that it patches the package-lock file before every npm install you run:

"scripts": {
  "preinstall": "npx npm-force-resolutions"
}

Now just run npm install as you would normally do:

npm install

To confirm that the right version was installed, use:

npm ls hoek

If your package-lock changes, you may need to run the steps above again.

Contributing

To build the project from source you'll need to install clojure. Then you can run:

npm install
npm run build