A dependency is just a package that your project uses. Very few javascript projects are entirely self-contained. When your project needs code from other projects in order to do its thing, those other projects are “dependencies” your project depends on them to run.

npm install "packagename"
✅this command adds package to dependency

When you install third-party packages via , you’re adding a dependency. Your project’s package.json file includes a list of your project’s dependencies.

In package.json file, there is an object called dependencies and it consists of all the packages that are used in the project with its version number. So, whenever you install any library that is required in your project that library you can find it in the dependencies object.

Dependency Versions:

Dependencies in Node.js have version numbers that consist of three parts: MAJOR.MINOR.PATCH. Each part serves a distinct purpose and impacts how the package should be utilized.

1. Major Version:

• Signifies significant changes, including breaking changes or introduction of new features.

• Upgrading to a major version may require updating your codebase to ensure compatibility.

• It is recommended to exercise caution when incorporating major updates into existing projects.

2. Minor Version:

• Includes backward-compatible bug fixes, performance improvements, or additional features.

• Updating to a minor version is generally safe and recommended to benefit from bug fixes and enhancements.

3. Patch Version:

• Contains minor fixes, patches, or security updates that address specific issues.

• Patch versions are optional but can be important for addressing vulnerabilities or specific problems.

Neglecting Versioning: A Security Risk:

Neglecting versioning practices in your Node.js applications poses a significant security risk. When you fail to prioritize updates and patches, you leave your application exposed to known vulnerabilities and potential security breaches.

For example, let's consider the widely used package "lodash" with a known security vulnerability in versions prior to 4.17.21. If you continue to use an outdated version, such as 4.17.10, without updating to the latest version, your application remains susceptible to the known security flaw. Malicious actors can exploit this vulnerability to execute arbitrary code or manipulate data, potentially compromising the integrity of your application and exposing sensitive information. By neglecting versioning and failing to stay up to date with security patches, you increase the chances of falling victim to security breaches and compromise the overall security of your Node.js application.

What are devDependencies?

devDependencies are modules that are only required during local development and testing, while dependencies are modules that are also required at runtime (that is during production)

The production environment is where users access the final code after all of the updates and testing

devDependencies are packages used for development purposes,

e.g for running tests or transpiling your code. Many packages that you install during development are not required for your app to work in production — so we add those to our package.json devDependencies object.

npm install "packagename" --save-dev
or 
npm install -D "packagename"
✅This command adds the package to devDependency

In package.json file, there is an object called as dev Dependencies and it consists of all the packages that are used in the project in its development phase and not in the production or testing environment with its version number

Installing Specific Versions:

To install a specific version of a package in Node.js, you can use the @ symbol followed by the desired version number.

Example: npm install express@4.17.9

Installing a specific version ensures that your project remains consistent and avoids unexpected updates within version ranges.

Dependencies | Official NPM Docs

Please do not put test harnesses or transpilers or other "development" time tools in your dependencies object. See devDependencies, below.

See semver for more details about specifying version ranges.

• version Must match version exactly

• >version Must be greater than version

• >=version etc

• <version

• <=version

• ~version "Approximately equivalent to version" See semver

• ^version "Compatible with version" See semver

• 1.2.x 1.2.0, 1.2.1, etc., but not 1.3.0

• http://... See 'URLs as Dependencies' below

• * Matches any version

• "" (just an empty string) Same as *

• version1 - version2 Same as >=version1 <=version2.

• range1 || range2 Passes if either range1 or range2 are satisfied.

• git... See 'Git URLs as Dependencies' below

• user/repo See 'GitHub URLs' below

• tag A specific version tagged and published as tag See npm dist-tag

• path/path/path See Local Paths below

For example, these are all valid:

{
  "dependencies": {
    "foo": "1.0.0 - 2.9999.9999",
    "bar": ">=1.0.2 <2.1.2",
    "baz": ">1.0.2 <=2.3.4",
    "boo": "2.0.1",
    "qux": "<1.0.0 || >=2.3.1 <2.4.5 || >=2.5.2 <3.0.0",
    "asd": "http://asdf.com/asdf.tar.gz",
    "til": "~1.2",
    "elf": "~1.2.3",
    "two": "2.x",
    "thr": "3.3.x",
    "lat": "latest",
    "dyl": "file:../dyl"
  }
}

What's the difference between tilde(~) and caret(^) in package.json?

• ~version “Approximately equivalent to version”, will update you to all future patch versions, without incrementing the minor version. ~1.2.3 will use releases from 1.2.3 to <1.3.0.

  

• ^version “Compatible with version”, will update you to all future minor/patch versions, without incrementing the major version. ^2.3.4 will use releases from 2.3.4 to <3.0.0

  

Our project will automatically update if we use caret sign (^)

Conclusion:

Understanding versioning is crucial for managing dependencies effectively in Node.js applications. By grasping the significance of different version parts, you can make informed decisions about when to update your dependencies. Exercise caution with major version updates, thoroughly test them, and update existing projects only after careful consideration. Additionally, keeping up to date with minor and patch versions is generally recommended to benefit from bug fixes, performance improvements, and security patches.

Thanks a lot for reading the article.
Hope you found it helpful.

Linkedin: https://www.linkedin.com/in/tautikk/
Email: tautikagrahari@gmail.com
Twitter: https://twitter.com/TautikA