I'm working on a pretty large React project and every time I install a new package I end up with crazy version conflicts. I've tried using npm ci but it doesn't always work, especially when I'm collaborating with others. Is there a smarter way to manage this without having to start from scratch?
When you have these conflicts, it usually happens when you install new packages with `npm install` without checking what it does to your `package-lock.json`, right?
The problem is that npm is a bit too flexible by default. First thing, make sure everyone on your team uses `npm ci` instead of `npm install` when working on an already-started project. The difference is that `npm ci` reads exactly what's in `package-lock.json` without modifying it, while `install` goes ahead and upgrades patch and minor versions whenever it feels like it. If you use `npm install` to add new stuff and then push the lock file, everyone else ends up with different versions. Also, always commit your `package-lock.json` to the repository - sounds obvious but a lot of people don't do it and then wonder why the build fails.
For new packages, use `npm install --save-exact` if you really want to freeze a specific version, or take a look at tools like `npm audit` to check if there are any known dependency conflicts. If the problem is really bad with a lot of nested dependencies, consider using `npm dedupe` every now and then to clean up your dependency tree. Actually, you could also try pnpm or yarn if you're willing to switch ecosystems - they handle dependencies in a more organized way - but if you want to stick with npm, following the `ci` + `package-lock.json` in git workflow should solve most of the mess.
Log into answer.
