On what basis does npm install install the package?

I always thought that typing npm install, alone would install the package according to the package.json in the project directory, but I encountered a problem.

I used a set of react scaffolding configured by others, and then changed it and uploaded it to git. Git prompted me that there was a serious security loophole in the hoek2.16 version, so let me update the package. I took a look at the package.json, in the directory without the hoek package, but in package-lock.json, the version was 2.16, so I deleted the hoek, in the nodemodules. Change the version in package-lock.json to 4.2.1 after npm install.

the installed version is still 2.16! And 4.2.1 in package-lock.json has all become 2.16, search the entire document did not find where the definition of the version 2.16!

Npm
Mar.20,2021

find out who hoek v2.16 is dependent, for example, by hawk ,
continue to check hawk by request ,
request by less ,
less has record dependency in package.json , then update less

.

you can also search / view everyone's ISSUE discussions on the github repository of a package in this dependency chain


indirect dependency.


there is a package in your package.json that has a hoek2.16 dependency. It is recommended that you search globally to find out which package refers to this

.
Menu