[BUG] npm update not updating package.json

[basickarl]

npm update does not update and write to package.json

node v12.14.1
npm v6.13.4
windows 10 pro 64-bit 1903 build 18362.592

Delete node_modules directory and package-lock.json, open cmd.exe and run the following:

C:\Users\karl\Development\langurama>npm install
npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated connect@2.30.2: connect 2.x series is deprecated
npm WARN deprecated json3@3.3.2: Please use the native JSON object instead of JSON 3
npm WARN deprecated circular-json@0.3.3: CircularJSON is in maintenance only, flatted is its successor.
npm WARN deprecated natives@1.1.6: This module relies on Node.js's internals and will break at some point. Do not use it, and update to graceful-fs@4.x.
npm WARN deprecated left-pad@1.3.0: use String.prototype.padStart()

> grpc@1.24.2 install C:\Users\karl\Development\langurama\node_modules\grpc
> node-pre-gyp install --fallback-to-build --library=static_library

node-pre-gyp WARN Using request for node-pre-gyp https download
[grpc] Success: "C:\Users\karl\Development\langurama\node_modules\grpc\src\node\extension_binary\node-v72-win32-x64-unknown\grpc_node.node" is installed via remote

> node-sass@4.13.1 install C:\Users\karl\Development\langurama\node_modules\node-sass
> node scripts/install.js

Cached binary found at C:\Users\karl\AppData\Roaming\npm-cache\node-sass\4.13.1\win32-x64-72_binding.node

> protobufjs@6.8.8 postinstall C:\Users\karl\Development\langurama\node_modules\protobufjs
> node scripts/postinstall


> node-sass@4.13.1 postinstall C:\Users\karl\Development\langurama\node_modules\node-sass
> node scripts/build.js

Binary found at C:\Users\karl\Development\langurama\node_modules\node-sass\vendor\win32-x64-72\binding.node
Testing binary
Binary is fine

> cypress@3.2.0 postinstall C:\Users\karl\Development\langurama\node_modules\cypress
> node index.js --exec install

Installing Cypress (version: 3.2.0)

 √  Downloaded Cypress
 √  Unzipped Cypress
 √  Finished Installation C:\Users\karl\AppData\Local\Cypress\Cache\3.2.0

You can now open Cypress by running: node_modules\.bin\cypress open

https://on.cypress.io/installing-cypress

npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN notsup Unsupported engine for amqplib@0.5.1: wanted: {"node":">=0.8 <6 || ^6"} (current: {"node":"12.14.1","npm":"6.13.4"})
npm WARN notsup Not compatible with your version of node/npm: amqplib@0.5.1
npm WARN notsup Unsupported engine for dissolve@0.3.3: wanted: {"node":"~0.10.0"} (current: {"node":"12.14.1","npm":"6.13.4"})
npm WARN notsup Not compatible with your version of node/npm: dissolve@0.3.3
npm WARN @lasso/marko-taglib@1.0.10 requires a peer of lasso-marko@>=2.4.0 but none is installed. You must install peer dependencies yourself.
npm WARN langurama@0.1.0 No license field.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.11 (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.11: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

added 1955 packages from 810 contributors and audited 889081 packages in 446.948s

20 packages are looking for funding
  run `npm fund` for details

found 41 vulnerabilities (21 low, 3 moderate, 15 high, 2 critical)
  run `npm audit fix` to fix them, or `npm audit` for details

C:\Users\karl\Development\langurama>npm update

C:\Users\karl\Development\langurama>npm outdated
Package                          Current  Wanted   Latest  Location
@babel/core                        7.4.3   7.4.3    7.8.3  langurama
@babel/plugin-transform-runtime    7.4.3   7.4.3    7.8.3  langurama
@babel/runtime                     7.4.3   7.4.3    7.8.3  langurama
@google-cloud/pubsub              0.28.1  0.28.1    1.3.0  langurama
@lasso/marko-taglib               1.0.10  1.0.10   1.0.15  langurama
amqplib                            0.5.1   0.5.1    0.5.5  langurama
bragi                              0.1.3   0.1.3    0.1.9  langurama
browser-refresh                    1.7.1   1.7.1    1.7.3  langurama
cypress                            3.2.0   3.2.0    3.8.2  langurama
eslint                            5.16.0  5.16.0    6.8.0  langurama
eslint-config-standard            12.0.0  12.0.0   14.1.0  langurama
eslint-plugin-import              2.16.0  2.16.0   2.20.0  langurama
eslint-plugin-node                 8.0.1   8.0.1   11.0.0  langurama
eslint-plugin-promise              4.1.1   4.1.1    4.2.1  langurama
eslint-plugin-standard             4.0.0   4.0.0    4.0.1  langurama
geoip-lite                         1.2.0   1.2.0    1.4.0  langurama
gm                                1.23.0  1.23.0   1.23.1  langurama
jwt-simple                         0.5.1   0.5.1    0.5.6  langurama
lasso                              3.2.3   3.2.3    3.3.1  langurama
lasso-marko                        2.3.0   2.3.0    2.4.8  langurama
marko                             4.16.9  4.16.9  4.18.34  langurama
mongodb                            3.1.1   3.1.1    3.5.1  langurama
passport-linkedin-oauth2           1.5.0   1.5.0    2.0.0  langurama
redux                              4.0.0   4.0.0    4.0.5  langurama
redux-logger                       3.0.0   3.0.0    3.0.6  langurama
redux-promise-middleware           6.1.0   6.1.0    6.1.2  langurama
redux-thunk                        2.2.0   2.2.0    2.3.0  langurama
request-promise-native             1.0.7   1.0.7    1.0.8  langurama
sass-lint                         1.12.1  1.12.1   1.13.1  langurama
socket.io                          2.1.1   2.1.1    2.3.0  langurama
socket.io-client                   2.1.1   2.1.1    2.3.0  langurama

I'm expecting the contents of package.json to be updated.

Here is my package.json:

{
    "name": "langurama",
    "version": "0.1.0",
    "description": "Langurama",
    "author": "Karl Morrison <karl@langurama.com>",
    "main": "application/server/index.js",
    "repository": {
        "type": "git",
        "url": "git+ssh://git@bitbucket.org/basickarl/langurama.git"
    },
    "type": "module",
    "engine": "12.14",
    "scripts": {
        "style": "npx prettier --check \"**/*.*\"",
        "style_fix": "npx prettier --write \"**/*.*\"",
        "lint": "npx eslint .",
        "------------": "",
        "setup_install_l": "NODE_PATH=\"$(pwd)\" sudo apt-get install -y graphicsmagick && npm install && npm rebuild node-sass",
        "setup_install_w": "",
        "setup_config_l": "NODE_ENV=development NODE_PATH=\"$(pwd)\" node application/tasks/generate_config.js",
        "setup_config_w": "cmd.exe /C \"set NODE_ENV=development && set NODE_PATH=.&& node application/tasks/generate_config.js\"",
        "setup_start_db_l_w": "docker pull mongo && docker run --name langurama -d -p 27017:27017 mongo",
        "setup_config_db_l_w": "mongo langurama application/tasks/setup_mongodb.js",
        "setup_pop_l--needfixing": "NODE_PATH=\"$(pwd)\" node application/tasks/populate_database.js",
        "setup_pop_w--needfixing": "cmd.exe /C \"set NODE_ENV=development && set NODE_PATH=.&& node application/tasks/populate_database.js",
        "drop_db_l_w--needfixing": "mongo langurama application/tasks/drop_mongodb.js",
        "dev_l": "NODE_ENV=development NODE_PATH=\"$(pwd)\" browser-refresh --nolazy --inspect=9229 application/server.js",
        "dev_w": "cmd.exe /C \"set NODE_ENV=development && set NODE_PATH=.&& browser-refresh --nolazy --inspect=9229 application/index.js\"",
        "dev_inspect_l": "NODE_ENV=development NODE_PATH=\"$(pwd)\" node --nolazy --inspect-brk=9229 application/server.js",
        "test_l": "NODE_ENV=test NODE_PATH=\"$(pwd)\" npx cypress",
        "start_l": "NODE_ENV=development NODE_PATH=\"$(pwd)\" node application/server.js",
        "lint_l_w": "node_modules/.bin/eslint ."
    },
    "devDependencies": {
        "@babel/plugin-transform-runtime": "7.4.3",
        "browser-refresh": "1.7.1",
        "cross-env": "6.0.3",
        "cypress": "3.2.0",
        "dotenv-extended": "2.7.1",
        "eslint": "5.16.0",
        "eslint-config-prettier": "6.9.0",
        "eslint-config-standard": "12.0.0",
        "eslint-plugin-import": "2.16.0",
        "eslint-plugin-node": "8.0.1",
        "eslint-plugin-promise": "4.1.1",
        "eslint-plugin-standard": "4.0.0",
        "jest": "24.9.0",
        "prettier": "1.19.1",
        "run-script-os": "1.0.7",
        "sass-lint": "1.12.1",
        "shelljs": "0.8.3"
    },
    "dependencies": {
        "@babel/core": "7.4.3",
        "@babel/preset-env": "7.8.3",
        "@babel/runtime": "7.4.3",
        "@google-cloud/pubsub": "0.28.1",
        "@lasso/marko-taglib": "1.0.10",
        "acorn": "7.1.0",
        "amqplib": "0.5.1",
        "bragi": "0.1.3",
        "browser-refresh-taglib": "1.1.0",
        "express": "4.17.1",
        "express-passport": "0.1.0",
        "fluent-ffmpeg": "2.1.2",
        "geoip-lite": "1.2.0",
        "gm": "1.23.0",
        "jwt-simple": "0.5.1",
        "lasso": "3.2.3",
        "lasso-babel-transform": "3.0.0",
        "lasso-marko": "2.3.0",
        "lasso-sass": "3.0.0",
        "marko": "4.16.9",
        "mongodb": "3.1.1",
        "node-native2ascii": "0.2.0",
        "node-wav-player": "0.1.0",
        "passport-facebook": "3.0.0",
        "passport-jwt": "4.0.0",
        "passport-linkedin-oauth2": "1.5.0",
        "passport-local": "1.0.0",
        "redux": "4.0.0",
        "redux-logger": "3.0.0",
        "redux-promise-middleware": "6.1.0",
        "redux-thunk": "2.2.0",
        "request-promise-native": "1.0.7",
        "require-self-ref": "2.0.1",
        "socket.io": "2.1.1",
        "socket.io-client": "2.1.1",
        "urlencode": "1.1.0"
    }
}

[ljharb]

Why would npm install ever modify package.json?

[basickarl]

@ljharb Hey man! I did that just to illustrate that I did a fresh install from scratch before running npm update. So I did an install then I did an update, but the update didn't change the package.json?

[ljharb]

Ah. npm update also shouldn’t change it afaik, it updates what’s on disk to match the package.json.

[collinalexbell]

@basickarl, you are specifying exact versions in your package.json instead of specifying minimum versions with caret or tilde dependencies. If you want npm update to work, use tilde or caret deps: https://stackoverflow.com/questions/22343224/whats-the-difference-between-tilde-and-caret-in-package-json

Please close this issue.

[ljharb]

Seems answered; can reopen if not.

[jalik]

I have the same issue, npm update does not update versions in package.json, but only in package-lock.json (npm v7).
However the official doc is stating that this should be the case:
https://docs.npmjs.com/cli/v7/commands/npm-update#description

As of npm@5.0.0, the npm update will change package.json to save the new version as the minimum required dependency. To get the old behavior, use npm update --no-save

I can confirm that this only happens with npm v7.5.1 and not v6.x.
All my versions are defined using ^x.x.x.

node v15.8.0 (official script install)
npm v7.5.1
OS: KDE neon User Edition 5.20 x86_64

As a side note, I also have nvm installed, but pointing to the system node binary, so should not affect anything.

[weirdyang]

I'm experiencing the same thing as @jalik, using caret or tilde, it does not update the package.json after running install or update.
npm: '7.5.4',
node: '14.15.4',

[jaysonwu991]

I also meet the same problem for not updating package.json when executing npm update, but something wired is that npm update do update packages, and I don't find what the difference between 6.x npm configs and 7.x npm configs is. Are there any solutions for that?

Versions Below

• npm: '7.5.3'
• node: '15.9.0'
• yarn: '1.22.10'

[el7cosmos]

I'm experiencing the same issue with @jalik, can we reopen this?

[LucasSymons]

I am having these same issues and even downgrading to 6.14.11 and 6.14.8 had no effect.

[bogdan-h]

Confirm - the same issue -> npm update will leave the package.json untouched. This is terribly confusing as it does not reflect the actual component's version.
npm version 7.6.3 ; node version : 14.8.0
I end up manually modifying the package.json + cleared the node_modules then npm install with the new versions.

[jaysonwu991]

Confirm - the same issue -> npm update will leave the package.json untouched. This is terribly confusing as it does not reflect the actual component's version.
npm version 7.6.3 ; node version : 14.8.0
I end up manually modifying the package.json + cleared the node_modules then npm install with the new versions.

I have to use npm-check-updates instead of modifying package.json manually, but I don't want it that way.

[dandmcd]

This issue just started for me the other day. Same as everyone else, npm version 7.6.3 is not updating package.json. This issue needs to be reopened.