node.jsgitexpressnpmshrinkwrap

Use the exact version of lib from NPM

We use the following lib as dependencies in our project https://github.com/rlidwka/sinopia

In this lib the package.json they use express https://github.com/rlidwka/sinopia/blob/master/package.yaml

dependencies:
  express: '>=5.0.0-0 <6.0.0-0'

which is very problematic and we cannot use it since version 5 (5.0.0-alpha.1) is not official outside
https://github.com/expressjs/express the npm released version is 4.14 my question is the following

  1. What is the sense to declare dependencies in this way which is not released yet?
  2. Is there a way somehow to restricted the version to 4.14 or other 5 version (not alfa version ) without doing fork to this repo ?
Solution

  • How do I override nested NPM dependency versions? suggests using a partial npm-shrinkwrap.json to achieve what you want.

    According to Allow partial npm-shrinkwrap.json to only force some dependencies, this is supported in npm@3.