When working on a project where the package-lock.json
is managed in source control to ensure consistency among all developers, there may be confusion surrounding the use of npm ci
versus npm install
.
According to npm documentation, developers should utilize npm ci
for setting up their development environment and potentially when updating dependencies. However, many npm projects still recommend using npm install
.
Is there a specific reason developers are advised to use npm install
over npm ci
? Are there any drawbacks to using npm ci
in this context?
It is noted that npm ci
deletes the entire node_modules
directory, potentially resulting in the re-downloading of dependencies already present. On the other hand, when using npm install
, there have been instances where it modifies the package-lock.json
, contrary to the expectation of maintaining uniformity across all developer environments.
Given these considerations, it is recommended to opt for npm ci
.
For examples of unexpected behavior associated with npm install
, refer to:
- Why does "npm install" rewrite package-lock.json?
- https://github.com/npm/npm/issues/17722
- https://github.com/npm/npm/issues/20434