Update dependencies within declared ranges
Medium risk
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Inspects available updates, then refreshes installed packages and the lockfile to the newest versions allowed by package.json.
nodenpmupdate
Commands
Review available versions before changing the dependency tree
npm outdatedInstall allowed updates without executing lifecycle scripts
npm update --ignore-scriptsVerification
npm outdatedUpdated packages no longer appear unless their latest release is outside the declared range.
Undo
Restore tracked dependency declarations and lockfile entries
git restore package.json package-lock.jsonRecreate node_modules without executing lifecycle scripts
npm install --ignore-scriptsPitfalls
- The undo steps require package.json and package-lock.json to be tracked in Git with the desired prior state.
- Lifecycle scripts are disabled during update and recovery; packages that depend on them may need separately reviewed setup.
- Updated packages can contain behavior changes even when versions satisfy existing ranges; run the project test suite afterward.