[MUSIC]
>> Hello, everyone. I'm Jen Looper.
In this video, we're going to see how to update
dependencies in your Node.js project.
The Node.js ecosystem moves really quickly
and packages get updated really frequently.
It's not rare to sometimes have multiple updates every day.
Thankfully, as we saw on the previous video,
we have the package-lock.json file,
and that allows you to lock all your dependency versions
to make sure you have a stable and consistent working environment.
But sooner or later,
you'll probably want to update to
a newer version of a library or a tool.
First, how do you check if an update is available in your project?
Open a terminal in your Node.js project folder
and type npm outdated.
Outdated packages will be listed.
You can see two different colors here.
Yellow means a newer version exists,
but the update is not in
the allowed version range specified in your package.json file.
Red means the package exists that's allowed by
the version range specified in your package.json,
meaning generally that you can safely update them.
By typing npm update,
all the packages in red will be updated into their latest version.
We can check that by running npm outdated once again.
Now what does it mean to have an update match the version range,
and how is that specified?
You can see the packages versions are made by three numbers.
This is just an industry standard convention
named semantic versioning.
This is a system that helps mitigate risks
coming in when using third-party libraries,
by expressing the type of changes that you or
some other developers are introducing
by using these three numbers.
We have the major version,
the minor version, and the patch version.
The major version is the leftmost number,
for example, the one in 1.0.0.
A change to this number means that you can
expect breaking changes in code.
A minor version is the middle number,
for example, the two in 1.2.0.
A change to this number means that features have been added.
Your code should still work and it's
generally safe to accept this update.
A patched version is the rightmost number,
for example, the three in 1.2.3.
A change to this number means that a change has been
applied that fixes something in the code that should have worked,
and it definitely should be saved to accept that update.
There are three special characters that
express the allowed update range.
This one, the caret,
is added by default when you use npm install the package.
It means that you allow minor and patch version updates,
but forbid major version updates.
You can generally safely update.
If you use the tilde, instead,
like this, it'll restrict the update range to patch updates only.
It can be useful for critical packages
such as the Compiler or Linter,
or sometimes new features
also mean that you have to change your code.
If you're extra cautious and don't want any updates,
just leave the version number like this.
On the opposite extreme, if you want to allow any update and all,
you can replace the version number entirely with a star,
like this, to always allow updates to the latest version.
Now back to the terminal, how do you proceed when you update
the yellow packages outside the allowed update range?
For these, you can't use npm update.
You have to re-install them with
explicitly telling them that you want the latest version.
For example, I would say npm
install express at the latest version.
You can see it changes up to four.
Since it was a major update,
it means that I may have to do some changes in my code.
For such cases, it might be helpful to look at
the change log on GitHub to see what you need to update.
Be really careful and make sure to always test
your project after updating to
make sure everything is still working.
As a bonus, if you don't like using
the command line to update your packages,
you could take a look at the version lens extension for
Visual Studio code and you'll find
the link in the video description.
See you in the next video to talk
about vulnerabilities in packages.