Is it possible to upgrade the "npm" in the package.json #423
Comments
|
Yes, this has been an issue for many people recently (see other issues).
I made an alpha version with upgraded npm. Let me know if this helps:
npm uninstall -g npm-check-updates
npm install -g npm-check-updates@v3-alpha
…On Mon, Feb 26, 2018 at 10:45 AM zrx8269 ***@***.***> wrote:
- node version: v6.10.2
- npm version: v3.10.10
- npm-check-updates version: 2.14.0
------------------------------
After install the "npm-check-updates" in my project, it will also install
its dependencies, but the version of "qs" module under "npm" is too low for
my security check, is it possible for you to update the "npm" version in
package.json?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#423>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/AAtyxPTWFkijdkVD6EZ_lnogOSHw78g1ks5tYn04gaJpZM4SS8Ct>
.
|
|
Thanks for your reply, but the same error occurs under the "npmi" package. |
|
Ah, good catch. Try now: |
|
Hi @raineorshine! Thanks for your work maintaining this library! 😊 Just to let you know: prerelease versions should be formatted like You might also consider tagging it as In any case, I'm excited to play with this version! |
|
Hi @billyjanitsch! Thank you. I must be getting rusty on my semver! In hindsight I should have done the |
raineorshine
added a commit
that referenced
this issue
Mar 4, 2018
|
@billyjanitsch I'm getting a |
|
That's odd. The man page says Anyway, thanks for fixing up the versioning! :) |
abernix
added a commit
to apollographql/apollo-server
that referenced
this issue
Apr 11, 2018
It appears that the intention of including `npm-check-updates` in this repository was to provide an easy way to update dependent packages from the console. This was originally introduced in [Ref 0]. Unfortunately, the `npm-check-updates` package has an explicit dependency on `npm@3`, which means that it includes the entire `npm` in its `node_modules`. I originally observed this when analyzing the test failures in [Ref 1] and [Ref 2] which indicated (in its npm error) that the npm version was v3.10.10. The explanation for this is relatively straight-forward: Older versions of npm uses an nested tree of `node_modules` directories while newer versions hoist `node_modules` (i.e. flatten) to the highest location possible and only nesting dependencies to meet conflicting version constraints. Unfortunately, that means that once `npm@3` was installed by the newer `npm@5` as a dependency of `npm-check-updates`, it was hoisted to the top-level `node_modules` directory, exposing `npm@3` to `npm-scripts` which directly call `npm` commands on the nested packages, as is done on this monorepo (with, for example the `postinstall` script which runs `npm run compile` in each of the server middleware packages). :face_palm: Overall, this package doesn't seem to provide enough value for us to continue to include it, especially since we have Renovate - coupled with the same information being available from `npm outdated` and `npm update` commands. I'm not sure why we would want to install newer versions than our "package.json" allows. Futhermore, looking at the issue tracker on `npm-check-updates`, I'm assuming this is the reason I've seen "`dezalgo`" install errors [Ref 3] on this repository recently and _possibly_ even a bizarrely corrupted npm cache I encountered recently (though admittedly, that could be a stretch). See also: [Ref 4]. [Ref 0]: d7ca07f7 [Ref 1]: https://circleci.com/gh/apollographql/apollo-server/1915 [Ref 2]: https://app.netlify.com/sites/apollo-server-docs/deploys/5acdd3b7 [Ref 3]: raineorshine/npm-check-updates#420 [Ref 4]: raineorshine/npm-check-updates#423
abernix
added a commit
to apollographql/apollo-server
that referenced
this issue
Apr 17, 2018
It appears that the intention of including `npm-check-updates` in this repository was to provide an easy way to update dependent packages from the console. This was originally introduced in [Ref 0]. Unfortunately, the `npm-check-updates` package has an explicit dependency on `npm@3`, which means that it includes the entire `npm` in its `node_modules`. I originally observed this when analyzing the test failures in [Ref 1] and [Ref 2] which indicated (in its npm error) that the npm version was v3.10.10. The explanation for this is relatively straight-forward: Older versions of npm uses an nested tree of `node_modules` directories while newer versions hoist `node_modules` (i.e. flatten) to the highest location possible and only nesting dependencies to meet conflicting version constraints. Unfortunately, that means that once `npm@3` was installed by the newer `npm@5` as a dependency of `npm-check-updates`, it was hoisted to the top-level `node_modules` directory, exposing `npm@3` to `npm-scripts` which directly call `npm` commands on the nested packages, as is done on this monorepo (with, for example the `postinstall` script which runs `npm run compile` in each of the server middleware packages). :face_palm: Overall, this package doesn't seem to provide enough value for us to continue to include it, especially since we have Renovate - coupled with the same information being available from `npm outdated` and `npm update` commands. I'm not sure why we would want to install newer versions than our "package.json" allows. Futhermore, looking at the issue tracker on `npm-check-updates`, I'm assuming this is the reason I've seen "`dezalgo`" install errors [Ref 3] on this repository recently and _possibly_ even a bizarrely corrupted npm cache I encountered recently (though admittedly, that could be a stretch). See also: [Ref 4]. [Ref 0]: d7ca07f7 [Ref 1]: https://circleci.com/gh/apollographql/apollo-server/1915 [Ref 2]: https://app.netlify.com/sites/apollo-server-docs/deploys/5acdd3b7 [Ref 3]: raineorshine/npm-check-updates#420 [Ref 4]: raineorshine/npm-check-updates#423
|
This is important because npm@3 requires gauge@2.6, which seems to be causing npm/npmlog#48 for me. What a fun chain of dependencies! |
|
Fixed in |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
After install the "npm-check-updates" in my project, it will also install its dependencies, but the version of "qs" module under "npm" is too low for my security check, is it possible for you to update the "npm" version in package.json?
Thanks very much.
The text was updated successfully, but these errors were encountered: