Update a single dependency
Medium risk
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Upgrades one package to its latest published version, updating both package.json and the lockfile, after checking how far behind it is.
nodenpmdependenciesupgrade
Parameters
The npm package to update, e.g. lodash.
Commands
See the installed, wanted, and latest versions of the package
npm outdated "<package_name>"Upgrade the package to the latest version without executing lifecycle scripts
npm install --ignore-scripts "<package_name>@latest"Verification
npm ls "<package_name>"The package resolves to the new version with no invalid markers.
Undo
Restore the previous manifests and reinstall the prior version
git restore package.json package-lock.json && npm ci --ignore-scriptsPitfalls
- Lifecycle scripts are disabled during the upgrade and undo; packages that rely on build or install scripts may need those run separately after review.
- @latest may be a new major version with breaking changes — read the package changelog before upgrading.
- Other packages may peer-depend on the old version; watch install output for peer dependency warnings.
- The undo step assumes package.json and package-lock.json are tracked by git with no uncommitted edits you want to keep.