npm, the Node.js Package Manager, Its Commands and package.json
View All Tags
When npm installs a package, it writes a version range into package.json: ^4.6.7 means "4.6.7 or any newer 4.x". If you want package.json to say exactly which version your project uses, one setting in a project's .npmrc makes every install save an exact version. This guide shows the default, the setting, how to pin a package that is already there, and the one-off flag.
npm comes with Node.js, but it doesn't stay in step with it: Node.js 26.13.0 ships with npm 11.20.0, while the newest npm is 12.2.2. When npm notices, it prints New major version of npm available! This guide checks your version, makes sure your Node.js can run the new one, and updates npm with one command.
A fresh Next.js app from create-next-app 16.4.6, with ESLint, printed npm warn deprecated eslint@9.39.5: This version is no longer supported. ESLint 9 reached end of life on August 6, 2026. Updating to ESLint 10.14.0 removes the warning; two scoped overrides keep npm audit at zero, and npm still warns that three Next.js lint plugins list only ESLint 9.
A brand-new Next.js app reported 7 moderate severity vulnerabilities before I had written a line of code, and npm audit fix changed nothing. All seven were one advisory in minimatch, deep inside the ESLint tools, with the fixed version outside the range its parent package accepts. A scoped overrides entry in package.json fixed it.
After I updated a new Next.js app to TypeScript 7.0.2, npm run lint stopped with typescript-eslint does not support TS 7.0. TypeScript 7.0 ships without the compiler API that typescript-eslint reads code with. The TypeScript team's own fix is two npm aliases: TypeScript 6's API for ESLint, and TypeScript 7's tsc for everything else.
create-next-app refused to create my Next.js app in web/agent-chat-ui with The application path is not writable, please check folder permissions and try again. The permissions were fine. The parent folder, web, didn't exist yet, and create-next-app reports a missing parent folder the same way as a locked one. Creating web first fixed it.
