If you are a developer who works with npm, you probably have seen the package.json file in your project. This file contains information about your project and its dependencies. One of the most important fields in the package.json file is the version field, which specifies the version of your project. But how do you choose a version number for your project? And what do the different symbols mean when you specify the versions of your dependencies?
In this blog post, I will explain how to use semantic versioning for your project and how to understand the version ranges of your dependencies.
Semantic versioning
Semantic versioning is a convention for assigning meaningful version numbers to software projects. It follows the format of MAJOR.MINOR.PATCH, where:
MAJOR is incremented when you make incompatible API changes
MINOR is incremented when you add functionality in a backward-compatible manner
PATCH is incremented when you make backward-compatible bug fixes
For example, if you have a project with the version 1.2.3 and you add a new feature without breaking any existing functionality, you can increase the MINOR part and make it 1.3.0. If you fix a bug without changing the API, you can increase the PATCH part and make it 1.3.1. If you change the API in a way that breaks existing code, you can increase the MAJOR part and make it 2.0.0.
Semantic versioning helps you communicate the changes in your project and avoid compatibility issues with other projects that depend on yours.
Version ranges
When you specify the versions of your dependencies in the package.json file, you can use different symbols to indicate the range of acceptable versions. These symbols are:
~ (tilde): This means that you accept any patch updates within the same minor version. For example, ~1.4.0 means that you accept any version from 1.4.0 to 1.4.x, but not 1.5.x or higher.
^ (caret): This means that you accept any minor or patch updates within the same major version. For example, ^1.4.0 means that you accept any version from 1.4.0 to 1.x.x, but not 2.x.x or higher.
* (asterisk): This means that you accept any version of the dependency. This is not recommended as it can introduce breaking changes or bugs without your control.
> (greater than), < (less than), >= (greater than or equal to), <= (less than or equal to): These symbols allow you to specify a range of versions using inequality operators. For example, >=1.4.0 <2.0.0 means that you accept any version from 1.4.0 to 1.x.x, but not 2.x.x or higher.
- (hyphen): This allows you to specify a range of versions using a dash. For example, 1.4.0 - 2.0.0 means that you accept any version from 1.4.0 to 2.0.0 inclusive.
|| (double pipe): This allows you to combine multiple ranges using an OR operator. For example, ^1.4.0 || ^2.0.0 means that you accept any version from 1.x.x or 2.x.x.
When you run npm install, npm will look at the version ranges of your dependencies and install the latest compatible version available.
Why use version ranges?
Using version ranges allows you to benefit from bug fixes and new features without having to update your package.json file every time a new version of a dependency is released.
However, there are also some risks involved with using version ranges:
You may introduce breaking changes or bugs if a dependency updates its API in an incompatible way within the same major version.
You may miss important updates if a dependency releases a new major version with significant improvements or security fixes.
You may have inconsistent results if different developers or environments install different versions of the same dependency.
To mitigate these risks, you can use tools like npm audit or npm outdated to check for vulnerabilities or outdated dependencies in your project.
You can also use tools like npm shrinkwrap or npm lockfile.
I hope this article helped you to better understand versioning in npm
Happy Coding ;)
