Understanding npm, package.json, and Dependency Management

Every Node project is defined by its package.json and the dependencies npm installs. Understanding versioning and lockfiles prevents the classic "works on my machine" failures.

package.json: The Manifest

This file declares your project’s name, scripts, and dependencies. The two dependency buckets matter:

Semantic Versioning

Versions are MAJOR.MINOR.PATCH. The range prefix controls how far npm will upgrade:

• ^1.2.3 — allow minor + patch (1.x.x)
• ~1.2.3 — allow patch only (1.2.x)
• 1.2.3 — exact pin

The Lockfile Is Sacred

package-lock.json records the exact resolved version of every package in the tree. Commit it. Use npm ci in CI/CD for reproducible installs:

npm ci        # clean, lockfile-exact install (CI/CD)
npm install   # may update the lockfile
npm audit     # check for known vulnerabilities

Healthy Dependency Habits

1. Commit the lockfile so installs are reproducible.
2. Audit regularly and update with intent, not panic.
3. Question every dependency — each one is code you now ship and trust.

A dependency is a liability as much as an asset. Add deliberately; remove ruthlessly.

What to Learn Next

• npm scripts for task automation
• Workspaces / monorepos for multi-package projects
• Supply-chain security practices