Build what's next on GitHub, the place for anyone from anywhere to build anything.
Join us October 28-29 in San Francisco or online for GitHub Universe, our flagship developer event uniting people, agents, and the world's code.
After much anticipation, the npm CLI version 7 is now generally available!
After much anticipation, the npm CLI version 7 is now generally available!
In addition to new features and some breaking changes, we have made a significant impact on the performance of npm 7 as compared to npm 6 including:
Please note, npm 7 is now published as latest to the npm registry and will be the default version installed when you run npm install --global npm. If you want to install npm 6, please run npm install --global npm@6.
Despite the massive overhaul to the internals of npm, we have worked tirelessly to ensure that there will be minimal disruptions to most workflows. That said, some changes are necessary to improve the overall developer experience. You can read up on the breaking changes in the announcement blog.
One change to take note of is the new lockfile format, which is backwards compatible with npm 6 users. The lockfile v2 unlocks the ability to do deterministic and reproducible builds to produce a package tree.
In prior versions, the yarn.lock files were ignored, the npm CLI can now use yarn.lock as the source of package metadata and resolution guidance. If a yarn.lock file is present, then npm will also keep it up-to-date with the contents of the package tree.
Running npm install with npm 7 in a project with a v1 lockfile will replace that lockfile with the new v2 format. To avoid this, you can run npm install --no-save.
Automatically installing peer dependencies is an exciting new feature introduced in npm 7. In previous versions of npm (4-6), peer dependencies conflicts presented a warning that versions were not compatible, but would still install dependencies without an error. npm 7 will block installations if an upstream dependency conflict is present that cannot be automatically resolved.
You have the option to retry with --force to bypass the conflict or --legacy-peer-deps command to ignore peer dependencies entirely (this behavior is similar to versions 4-6).
Since many packages in the ecosystem have come to rely on loose peer dependencies resolutions, npm 7 will print a warning and work around most peer conflicts that exist deep within the package tree, since you can’t fix those anyway. To enforce strictly correct peer dependency resolutions at all levels, use the --strict-peer-deps flag.
We want to conclude by giving a big shout out to our community members who submitted changes, participated in the RFC calls, provided feedback, and were early adopters. We strive to continue to improve the npm CLI, so If you have future feedback, please leverage the npm/feedback repository discussions.
