Module 41: Node.js Fundamentals
npm and package.json in depth
🏠The everyday picture
A recipe that lists exact brands and pack sizes, so anyone who follows it gets the same dish, not "some flour".
📘What it really is
package.jsondescribes the project: name, scripts, and two lists of packages:dependencies: needed to run the app (for example Express);-
devDependencies: needed only for development (TypeScript, test tools). -
Version ranges:
"express": "^5.1.0"means "5.1.0 or any later 5.x". Version numbers follow semantic versioning: MAJOR.MINOR.PATCH. A major change may break your code; minor adds features; patch fixes bugs. -
package-lock.jsonrecords the exact versions installed, including packages' own dependencies. Commit it, so everyone (and the server) installs exactly the same set.npm ciinstalls exactly what the lock file says. -
Useful commands:
npm install express/npm install --save-dev vitest;npm uninstall name;npm outdated: what has newer versions;-
npm audit: known security problems in your packages. -
Supply-chain safety: every package you add is code from a stranger running on your server. Prefer well-known, maintained packages; check weekly downloads and recent updates; watch for misspelt names (
expresss), a common trick. Ask whether you need a package at all.
🖱️Try it
In enquiries-api, install express and, as development tools, typescript, @types/express and @types/node.
Open package.json and package-lock.json and find Express in each. Run npm audit and npm outdated. Commit,
making sure node_modules is in .gitignore and the lock file is included.
✅Quick check
Should package-lock.json be committed?
Show the answer
Yes. It ensures everyone installs exactly the same versions.
An AI suggests installing a package you've never heard of with 40 downloads a week. What do you check?
Show the answer
Whether it's needed at all, whether it's maintained and trusted, and that the name isn't a look-alike of a popular package.