Pin a dependency to an exact version

Bash

Caret ranges are how a build that passed last week fails today. Exact versions plus a lockfile remove the surprise.

npm install --save-exact express@5.1.0

# Make it the default for this project:
npm config set save-exact true --location project

# Install exactly what the lockfile says, nothing newer:
npm ci

Download

Build & CI npm dependencies reproducibility chris

More in Build & CI

A Makefile that documents itself Build & CI Running make with no arguments prints every target that carries a comment. A GitHub Actions workflow for a Node project Build & CI Caches the dependency install, runs on a matrix of versions, and fails the build on a lint error. Cache busting with a content hash Build & CI Names the built file after its contents so a deploy invalidates the cache without a version bump.

Random picks

Sum a column with awk Text Processing Adds the third field of every line and prints the total, ignoring anything non-numeric. Fetch with a timeout JavaScript fetch has no timeout of its own. AbortSignal.timeout is the short way to give it one. Show which process is holding a port Shell Answers 'address already in use' without guessing. Table sizes, largest first Databases Where the disk actually went, including indexes and TOAST. List branches merged into main Git Finds the branches that are safe to delete, and the ones that are not. Compose file with a healthcheck and dependency order Containers Makes the app wait until Postgres actually answers, not merely until its container has started. Security headers for an Express app Security The handful worth setting even when you are not using a framework that sets them for you. Worker pool with a wait group in Go Systems Fixed number of goroutines draining a channel, with the group ensuring main waits for all of them.