Running `npm install` instead of `npm update`

[day0ops]

Is there any reason why npm update is chosen over npm install.

I have a install script in package.json and its failing to run as the build is running npm update. Whats the best way to run npm install via sbt ?

[Enet4]

I am not entirely sure of how many people may stumble upon this in the future, but we've been unable to update our development dependencies for a while (the ecosystem around sbt-web and sbt-js-engine is one of the blockers), and so any information that we provide may become useful later on.

npm install is the correct command to install all modules listed as dependencies in the package.json file. The process of installing includes fetching and extracting packages into node_modules, as well as invoking certain package lifecycle hooks that make the modules ready to be used, namely the prepare script (or prepublish in older versions).

npm update serves a different purpose, which is to update the listed modules to the latest version while respecting the given version constraints according to semver. It will by default update the files package.json and any package dependency lock file (package-lock.json or npm-shrinkwrap.json). What could cause issues when integrating via sbt-js-engine and typesafehub/npm is that this command will not call the given project's preparation scripts, whereas npm install would. Updating dependencies is also a process which maintainers may want to be in control of. Doing so at this step would be undesirable.

The documentation links refer to npm v6, but the overall idea hasn't changed. In addition, there is also npm ci, which some users may prefer over npm install, because it ensures a consistent fresh build while checking that the package dependencies and the given package lock are aligned. As the name implies, it is often recommended for continuous integration.

In short, npm install should be the preferred command for the task.

would you be able to file this issue at https://github.com/typesafehub/npm instead?

That would be part of the process. From what I could gather, the Npm construct would have to be extended to provide more operations, including install, and then this project would need to use this new method to install modules. I filed typesafehub/npm#28 for the time being.

[mkurz]

Starting with version 1.3.0, when using a local installed js engine that supports node, sbt-js-engine tries to detect the systems npm command and will use it instead of the npm webjars.
This is the new default and can be disabled with npmPreferSystemInstalledNpm := false, to keep using the webjar npm, no matter what the engine is.

Also, starting with 1.3.0, it will be possible to set which npm subcommand is used by setting npmSubcommand := NpmSubcommand.Install (available options are Install, Update, Ci). update will stay the default however.

BTW: The npm project is archived and it has been folded into sbt-js-engine now.