The package.json file often contains the minimum version required for the dependency. For example, you could have "^ 1.0.0" which corresponds to version 1.0.0 or any minor releases.
{
"name": "my_package",
"version": "1.0.0",
"dependencies": {
"my_dep": "^1.0.0"
}
}
When you run npm install, it can install version 1.0.0, 1.1.0, 1.2.0, etc. "my_dep" because all of these versions meet the requirements of package.json. Ultimately, you can use version 1.0.0 on your local computer and 1.1.0 in a test environment.
yarn.lock , , "my_dep" . - :
my_dep@^1.0.0:
version "1.1.0"
resolved "https://registry.npmjs.org/my_dep/-/my_dep-1.1.0.tgz#a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0"
"my_dep" 1.1.0, (1.2.0).
narn.lock (, git mercurial). Yarn , CI.
:
https://docs.npmjs.com/getting-started/using-a-package.json
https://docs.npmjs.com/getting-started/semantic-versioning
https://yarnpkg.com/en/docs/yarn-lock