Skip to content

Chapter 7 of 8

Package Management and Project Configuration

npm, the Node Package Manager, is the default way to share and consume JavaScript libraries. It provides both a command-line tool and a vast public registry hosting millions of packages. Common commands include npm install to add dependencies, npm update to upgrade them, npm run to execute scripts defined in package.json, npm init to scaffold a new project, and npm publish to share your own package with the world.

Every Node.js project is described by a package.json manifest file. It contains the project's name and version, custom scripts (invoked with npm run), the dependencies needed at runtime, devDependencies needed only during development and testing, the main or module entry point that determines which file is loaded when the package is required, and an engines field declaring the required Node.js version. The distinction between dependencies and devDependencies matters: when deploying to production, npm install --production skips devDependencies to keep installs lean and fast.

Reproducible installs across machines and team members are ensured by package-lock.json, an auto-generated file that records the exact version of every dependency and sub-dependency. Always committing this file to version control prevents unexpected version drift and security surprises. npm uses semantic versioning (semver) in the form MAJOR.MINOR.PATCH: a major bump signals breaking changes, a minor bump adds backward-compatible features, and a patch bump fixes bugs. The caret prefix (^1.2.3) allows minor and patch updates, the tilde prefix (~1.2.3) allows only patch updates, and a bare version (1.2.3) pins the exact release.

Configuration that changes between environments, such as database URLs or API keys, is handled through environment variables accessed via process.env. Values can be set in the shell, in a .env file loaded with the dotenv package, or through system configuration. The .env file should always be added to .gitignore so secrets are not committed, and a .env.example file should be provided as a template for new developers.

All chapters
  1. 1Foundations of Node.js and the Event Loop
  2. 2Module Systems
  3. 3Streams and Buffers
  4. 4Asynchronous Programming
  5. 5Building Web Applications with Express
  6. 6Core Built-in Modules
  7. 7Package Management and Project Configuration
  8. 8Error Handling, Process Management, and Events

Drill it

Reading is not remembering. These come from the Nodejs Runtime deck:

Q

What is Node.js?

Node.js is a JavaScript runtime built on Chrome's V8 engine. It allows running JavaScript outside the browser, using an event-driven, non-blocking I/O model tha...

Q

What is the Node.js event loop?

The event loop is the mechanism that allows Node.js to perform non-blocking I/O operations despite JavaScript being single-threaded. It continuously checks the...

Q

What are the phases of the Node.js event loop?

Timers – executes setTimeout and setInterval callbacksPending callbacks – I/O callbacks deferred to next iterationPoll – retrieves new I/O eventsCheck – execute...

Q

What is the difference between setImmediate() and setTimeout()?

setImmediate() executes in the check phase of the event loop, after the poll phase completes. setTimeout(fn, 0) executes in the timers phase on the next iterati...

Study all 50 cards → Export to Anki