使用“ npm ci”代替“ npm install”进行确定性的项目设置

Question

Given a project where the package-lock.json is managed in source control with the goal that all developers on the team get exactly the same dependencies.

From the documentation of npm I think developers should use npm ci to set up their development environment and probably also later when dependencies are updated.

However the instructions I see in typical npm projects is still to use npm install.

Is there a reason developers should use npm install instead of npm ci? Does npm ci have disadvantages in this scenario?

I understand that npm ci does delete the whole node_modules and therefore potentially re-download some dependencies that were already present.

But with npm install I had regularly the case that an npm install is actually changing the package-lock.json (see links below), which is definitely not what is expected in a traditional project setup, where the main goal is that all developers get the same environment.
Therefore I would like to recommend to use npm ci.

Examples of "unexpected" behavior of npm install:

• Why does "npm install" rewrite package-lock.json?
• https://github.com/npm/npm/issues/17722
• https://npm.community/t/package-lock-json-keeps-changing-between-platforms-and-runs/1129/3
• https://github.com/npm/npm/issues/20434
• https://npm.community/t/package-lock-json-changes-from-one-npm-install-to-the-next/1454

Answer 1

没有理由在本地构建存储库或更新依赖项时使用而不是（因为它使用 npm 缓存，速度与 大致相同），但有以下情况可能是首选：npm cinpm inpm inpm i

1. 您实际上希望自动接收直接依赖项的次要/补丁更新；
2. 如果您对 中的版本进行了手动更改package.json并希望它们胜过package-lock.json.