[BUG] npx does not attempt to get newer versions

[jsg2021]

Current Behavior:

I have been using npx <some-workflow-helper> over the past year to run the current version of a command without having to manage updating it. npm7 does not pull the latest version if I have run it once before... i suspect because its no longer a temp install...

Expected Behavior:

npx some-package always runs the latest published version.

Steps To Reproduce:

1. npx <test-package>
2. publish a new version of
3. npx <test-package>

Environment:

• OS: Fedora 33
• Node: 14.15.0
• npm: 7.1.0

[ljharb]

If it’s installed locally or globally, it won’t fetch a version. If you want to force that, add @latest

[jsg2021]

If I never "install" it and only use npx <> to run it, on npm6 you would always get the latest without extra args. Also, it wasn't actually installed, it was only temporarily installed... after running it was discarded. We lost that on npm7.

[jsg2021]

I should amend ... yes, if the command exists it should obviously prefer that one. However, a command installed by npx should not be considered "installed"

[leafac]

I ran into this issue as well (see #2329).

Here’s some more information I gathered:

1. If you don’t have a command installed, then npx installs the package into the npm cache (on my machine that cache lives in ~/.npm).
2. If you run npx <command>@latest then npx fetches the latest version. But the next time you run just npx <command> again it’ll get the older version.
3. One workaround to force the package to update is to destroy the cache: rm -rf ~/.npm.

I think the best solution would be to mimic the behavior of running commands installed via npm install --global:

1. Provide some sort of npx --udpate <command>.
2. If the command is in the cache and you run npx <command>@latest, then the next time you run npx <command> it should choose the latest.
3. If the command is in the cache and you run just npx <command> then it should not check if there are updates available. First because you may not want to use the latest version, but more importantly you may not want to slow down running the command by going to the registry look for newer versions.

[jsg2021]

I think the best solution would be to mimic the behavior of running commands installed via npm install --global:

1. Provide some sort of npx --udpate <command>.
2. If the command is in the cache and you run npx <command>@latest, then the next time you run npx <command> it should choose the latest.
3. If the command is in the cache and you run just npx <command> then it should not check if there are updates available. First because you may not want to use the latest version, but more importantly you may not want to slow down running the command by going to the registry look for newer versions.

I respectfully disagree. Unless actually installed (globally, or locally) the cache should only be used if the current match matches, otherwise it should pull a new one (and in npm7's case prompt, unless --yes is present). The whole reason for npx is to run commands in the npm context that you may not have nor care to keep track of. (for example internal CI or workflow tools that you rather not spend time updating across all the runners.)

For your use case, you would be better off by installing the command and running with the --no-install flag.

[leafac]

You make good points. Thanks for reading my proposal and for the feedback.

The whole reason for npx is to run commands in the npm context that you may not have nor care to keep track of. (for example internal CI or workflow tools that you rather not spend time updating across all the runners.)

For me, the whole reason for npx is somewhat different. It’s being able to tell people: “If you have Node.js installed, go ahead and use my tool simply by running npx obs-cli (for example); no installation necessary.” That’s only half-true, of course, because npx is installing the thing, but it doesn’t feel like it because it’s just on the cache; it doesn’t even show up on npm --global ls. The reduced friction of trying something without having to “install” it is appealing to some people (myself included).

[jsg2021]

@leafac I believe we are saying the same thing at this point.

However, where I think we differ is the point of updating. I believe the convenance of not installing should come with the burden of always getting the latest... only falling back to cache if the latest is cached.

[leafac]

You make a good point…

[darcyclarke]

I believe #2592 should fix this issue once landed & is a duplicate of, if not related to, #2395