Recommended Free Tools
For repeatable npm installs, commit both package.json and package-lock.json, then use npm ci in clean builds. The lockfile records the resolved dependency tree; pinning direct dependencies to exact versions is an optional, stricter manifest policy. Neither approach proves that a package is trustworthy or safe to run.
What “pinning” means in npm
package.json declares the dependency specifications your project accepts. A specification may be a semver range, while package-lock.json records the exact dependency tree npm generated. npm describes the lockfile as enabling subsequent installs to generate identical trees despite intermediate dependency updates. Commit it so developers, deployments, and CI can use the project’s resolved tree. See npm’s package-lock.json documentation.
As an Amazon Associate I earn from qualifying purchases.
There are two related but distinct choices: whether direct dependencies are written as exact versions in the manifest, and whether the project commits its lockfile. A committed lockfile is the key project-level record of resolved versions; exact manifest entries make the direct-dependency specification stricter when the lockfile is refreshed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Approach | What it specifies | Practical effect |
|---|---|---|
Semver range in package.json plus committed lockfile |
An acceptable range for the direct dependency; resolved versions for the dependency tree in the lockfile. | Repeatable installs from the committed tree, while an intentional lockfile refresh can select a newer version that satisfies the range. |
| Exact direct-dependency version plus committed lockfile | A specific direct version in the manifest, alongside the resolved tree in the lockfile. | Stricter direct-dependency intent in the manifest; it does not replace the lockfile or guarantee that transitive dependencies remain unchanged when the lockfile is regenerated. |
Use npm install --save-exact (or npm install -E) when adding a dependency if your team has chosen exact direct-dependency entries. This is a policy decision, not a security feature. npm’s install documentation and ci documentation describe the manifest and lockfile behaviors.
#1 Best Overall
Set up repeatable installs
- Add or update dependencies intentionally with
npm install. Decide whether new direct dependencies should use exact versions, and review the resulting manifest and lockfile changes. - Commit both
package.jsonandpackage-lock.jsontogether. The lockfile must correspond to the manifest you intend to build. - Use
npm cifor clean automated builds and deployments. It requires a lockfile, removes an existingnode_modules, errors if the manifest and lockfile disagree, and does not write either file. - Keep lockfile-generation settings consistent. If the lockfile was generated with tree-shaping options such as
--legacy-peer-depsor--install-links, npm says the same settings must be used withnpm ci. A project-level.npmrccan preserve project settings for installs.
Use npm install when intentionally changing dependencies and the lockfile; use npm ci when the goal is a clean install of the committed tree. If npm ci reports a mismatch, reconcile the manifest and lockfile through an intentional dependency update, then commit the matching files rather than treating the error as a reason to bypass the lockfile.
Review dependency changes and keep updates moving
A frozen tree is reproducible, not permanently appropriate. Dependencies still need updates as maintainers address vulnerabilities, bugs, and compatibility changes. Treat lockfile changes as code changes: inspect which packages were added, removed, or updated, and review the reason for the change and its compatibility impact.
- Review pull requests: GitHub dependency review can expose dependency changes in a pull request, giving maintainers a focused view of additions, removals, and updates. GitHub’s supply-chain security documentation describes dependency review and related tools.
- Check known vulnerabilities:
npm auditreports known vulnerabilities in dependencies.npm audit fixcan attempt compatible fixes, but npm notes that some issues require manual intervention or review. An automated fix can alter the dependency tree, so inspect the resulting changes and run the project’s tests. - Evaluate major updates: A major-version update can change behavior. Review it and test it rather than applying it blindly just to clear an alert.
- Use automated proposals as inputs: Dependabot can surface vulnerability alerts and propose security or version updates. A proposed update still needs compatibility and risk assessment by maintainers.
The npm audit reference available here is for legacy npm CLI v6; confirm current command behavior and configuration against the npm version used by your project. npm’s v6 audit documentation explains that some findings need manual review.
Understand what a lockfile cannot protect against
A lockfile controls repeatability of dependency resolution; it does not judge whether the selected release is trustworthy, prevent package code from running during installation, or guarantee that vulnerabilities will be fixed. npm documents lifecycle scripts—including prepare—that run in specified install and packaging contexts, including some Git dependency installs. A frozen tree is therefore not an inert install. Review dependency sources and lifecycle behavior as part of the project’s risk controls. See npm’s scripts documentation.
Rank #3
Known-vulnerability checks and origin or integrity checks answer different questions. Auditing can flag reported vulnerabilities, while registry signatures and provenance can provide integrity or build-origin evidence. Neither establishes that package behavior is harmless; maintainers still need to review changes and respond to risk.
Use provenance and trusted publishing where they fit
For teams publishing npm packages, trusted publishing can use OIDC from supported CI providers instead of long-lived write tokens. npm’s current guide lists npm CLI 11.5.1 or later and Node 22.14.0 or later as prerequisites. It documents cloud-hosted support for GitHub Actions, GitLab CI/CD, and CircleCI; automatic provenance support is narrower and described for GitHub Actions and GitLab CI/CD under specified conditions. Check the current provider, runner, and repository requirements before adopting it, because support conditions can change. See npm’s trusted publishing guide.
Rank #4
When provenance is available, it can link a published package to its source, build, and publisher for inspection. npm explicitly warns that provenance does not guarantee a package has no malicious code. Consumers can inspect available attestations and run npm audit signatures with npm CLI v9.5.0 or later to check registry signatures and provenance attestations. See npm’s provenance documentation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Account for npm version differences
Lockfile format semantics vary across npm generations, so teams using older npm versions should verify compatibility across developer machines and build environments before changing toolchains. The current npm package-lock documentation surfaced as npm Docs v12.1.0 (Latest) notes that npm v12 no longer reads or writes npm-shrinkwrap.json; projects committed to that version-specific file should rename it to package-lock.json when migrating to npm v12. Confirm behavior for the npm release you actually use. npm’s package-lock documentation covers the relevant format and migration details.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
