{"id":16429943,"url":"https://github.com/smarlhens/npm-pin-dependencies","last_synced_at":"2026-04-03T00:00:19.713Z","repository":{"id":65186886,"uuid":"585704935","full_name":"smarlhens/npm-pin-dependencies","owner":"smarlhens","description":"Pin your dependency versions based on lock file using installed versions.","archived":false,"fork":false,"pushed_at":"2026-03-28T09:23:36.000Z","size":921,"stargazers_count":9,"open_issues_count":6,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-03-28T13:54:18.186Z","etag":null,"topics":["cli","dependencies","node","nodejs","npd","npm","pin","pnpm","yarn"],"latest_commit_sha":null,"homepage":"https://www.npmjs.com/package/@smarlhens/npm-pin-dependencies","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/smarlhens.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-01-05T21:22:18.000Z","updated_at":"2025-09-28T16:48:15.000Z","dependencies_parsed_at":"2025-12-08T11:05:31.633Z","dependency_job_id":null,"html_url":"https://github.com/smarlhens/npm-pin-dependencies","commit_stats":null,"previous_names":[],"tags_count":22,"template":false,"template_full_name":null,"purl":"pkg:github/smarlhens/npm-pin-dependencies","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smarlhens%2Fnpm-pin-dependencies","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smarlhens%2Fnpm-pin-dependencies/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smarlhens%2Fnpm-pin-dependencies/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smarlhens%2Fnpm-pin-dependencies/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/smarlhens","download_url":"https://codeload.github.com/smarlhens/npm-pin-dependencies/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smarlhens%2Fnpm-pin-dependencies/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31319715,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-02T23:57:25.032Z","status":"ssl_error","status_checked_at":"2026-04-02T23:57:06.281Z","response_time":89,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","dependencies","node","nodejs","npd","npm","pin","pnpm","yarn"],"created_at":"2024-10-11T08:24:59.868Z","updated_at":"2026-04-03T00:00:19.707Z","avatar_url":"https://github.com/smarlhens.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# NPM pin dependencies\n\n[![CodeQL](https://github.com/smarlhens/npm-pin-dependencies/workflows/codeql/badge.svg)](https://github.com/smarlhens/npm-pin-dependencies/actions/workflows/codeql.yml)\n[![GitHub CI](https://github.com/smarlhens/npm-pin-dependencies/workflows/ci/badge.svg)](https://github.com/smarlhens/npm-pin-dependencies/actions/workflows/ci.yml)\n![node-current (scoped)](https://img.shields.io/node/v/@smarlhens/npm-pin-dependencies)\n[![GitHub license](https://img.shields.io/github/license/smarlhens/npm-pin-dependencies)](https://github.com/smarlhens/npm-pin-dependencies)\n[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://github.com/prettier/prettier)\n[![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg)](https://conventionalcommits.org)\n\n**npm-pin-dependencies will pin your dependency versions based on lock file using installed versions.**\n\n---\n\n## Table of Contents\n\n- [Prerequisites](#prerequisites)\n- [Installation](#installation)\n- [Usage](#usage)\n  - [CLI](#cli)\n  - [Node](#node)\n- [Options](#options)\n- [Debug](#debug)\n\n---\n\n## Prerequisites\n\n- [Node.JS](https://nodejs.org/en/download/) **version ^20.19.0 || ^22.12.0 || \u003e=24.0.0**\n\n---\n\n## Installation\n\nInstall globally:\n\n```sh\nnpm install -g @smarlhens/npm-pin-dependencies\n```\n\nOr run with [npx](https://docs.npmjs.com/cli/v8/commands/npx):\n\n```sh\nnpx @smarlhens/npm-pin-dependencies\n```\n\n---\n\n## Usage\n\n### CLI\n\nWill pin `package.json` dependency versions for the project in the current directory based on the npm `package-lock.json` file:\n\n```sh\n$ npd\n```\n\nUpgrade a project's `package.json` file:\n\n```sh\n$ npd -u\n```\n\n### Node\n\n```typescript\nimport {\n  pinDependenciesFromString,\n  validatePackageJsonString,\n  validatePackageLockString,\n} from '@smarlhens/npm-pin-dependencies';\n\nlet packageJsonString = ''; // load content of package.json as stringified JSON\nlet packageLockString = ''; // load content of package-lock.json as stringified JSON\n\nvalidatePackageJsonString({ packageJsonString }); // can throw Errors if unexpected format\nvalidatePackageLockString({ packageLockString }); // can throw Errors if unexpected format\n\n// packageJson is the content of your package.json with pinned dependencies\n// versionsToPin contains changes if you want to display them\nconst { versionsToPin, packageJson } = pinDependenciesFromString({\n  packageJsonString,\n  packageLockString,\n});\nconsole.log(packageJson);\nconsole.log(\n  versionsToPin\n    .map(({ pinnedVersion, version, dependency }) =\u003e `${dependency} version ${version} replaced by ${pinnedVersion}`)\n    .join('\\n'),\n);\n```\n\n---\n\n## Options\n\n```text\nUsage: npd [options]\n\nOptions:\n  -q, --quiet    Enable quiet mode.                                [boolean] [default: false]\n  -d, --debug    Enable debug mode. Can be used with environment variable DEBUG=npd.\n                                                                   [boolean] [default: false]\n  -v, --verbose  A little more detailed than the default output.   [boolean] [default: false]\n  -u, --update   Update dependency versions in package.json file.  [boolean] [default: false]\n      --enableSaveExact  Enable save exact.                        [boolean] [default: false]\n      --help     Show help                                                          [boolean]\n      --version  Show version number                                                [boolean]\n\nExamples:\n  npd     Check installed dependency versions based on package-lock.json file in the current\n          working directory.\n  npd -u  Pin package.json dependency versions based on package-lock.json file in the current\n           working directory.\n\n© 2023 Samuel MARLHENS\n```\n\n---\n\n## Debug\n\n```sh\n$ DEBUG=* npd -d\n```\n\n\u003cdetails\u003e\n\n\u003csummary\u003eoutput with debug\u003c/summary\u003e\n\n```text\n[STARTED] Pinning dependency versions in package.json file...\n[STARTED] Reading package-lock.json...\n[SUCCESS] Reading package-lock.json...\n[STARTED] Reading yarn.lock...\n[SUCCESS] Reading yarn.lock...\n[STARTED] Reading package.json...\n[SUCCESS] Reading package.json...\n[STARTED] Validating package-lock.json...\n[SUCCESS] Validating package-lock.json...\n[STARTED] Validating yarn.lock...\n[SKIPPED] Validating yarn.lock...\n[STARTED] Validating package.json...\n[SUCCESS] Validating package.json...\n[STARTED] Computing which dependency versions are to pin...\n  npd Dependency fake-package-1 version is not pinned: ^1.0.0 -\u003e 1.1.0. +0ms\n  npd Dependency fake-package-2 version is not pinned: ~2.5.0 -\u003e 2.5.2. +0ms\n  npd Dependency fake-package-3 version is not pinned: 3.x -\u003e 3.1.1. +0ms\n  npd Dependency fake-package-4 version is not pinned: ^0.0.3 -\u003e 0.0.3. +0ms\n  npd Dependency fake-package-5 version is not pinned: ~0.0.3 -\u003e 0.0.9. +0ms\n  npd Dependency fake-package-6 version is not pinned: ^0.1.0 -\u003e 0.1.0. +0ms\n  npd Dependency fake-package-7 version is not pinned: ~0.1.0 -\u003e 0.1.1. +0ms\n  npd Dependency fake-package-8 version is already pinned. +0ms\n  npd Dependency fake-package-9 version is not pinned: 1.0.0 - 1.2.0 -\u003e 1.1.1. +0ms\n  npd Dependency fake-package-10 version is not pinned: \u003e2.1 -\u003e 2.2.2. +0ms\n  npd Dependency fake-package-11 version is not pinned: ^2 \u003c2.2 || \u003e 2.3 -\u003e 2.1.6. +0ms\n  npd Dependency fake-package-12 version is not pinned: ^2 \u003c2.2 || \u003e 2.3 -\u003e 2.4.2. +1ms\n  npd Dependency fake-dev-package-1 version is not pinned: ^4.0.0 -\u003e 4.0.0. +0ms\n  npd Dependency fake-dev-package-2 version is not pinned: ~5.0.0 -\u003e 5.0.0. +0ms\n  npd Dependency fake-dev-package-3 version is not pinned: 6.x -\u003e 6.0.0. +0ms\n  npd Dependency fake-optional-package-1 version is not pinned: ^7.0.0 -\u003e 7.0.0. +0ms\n  npd Dependency fake-optional-package-2 version is not pinned: ~8.0.0 -\u003e 8.0.0. +0ms\n  npd Dependency fake-optional-package-3 version is not pinned: 9.x -\u003e 9.0.0. +0ms\n[SUCCESS] Computing which dependency versions are to pin...\n[STARTED] Output dependency versions that can be pinned...\n[TITLE] Dependency versions that can be pinned:\n[TITLE]\n[TITLE]  fake-package-1           ^1.0.0            →  1.1.0\n[TITLE]  fake-package-2           ~2.5.0            →  2.5.2\n[TITLE]  fake-package-3           3.x               →  3.1.1\n[TITLE]  fake-package-4           ^0.0.3            →  0.0.3\n[TITLE]  fake-package-5           ~0.0.3            →  0.0.9\n[TITLE]  fake-package-6           ^0.1.0            →  0.1.0\n[TITLE]  fake-package-7           ~0.1.0            →  0.1.1\n[TITLE]  fake-package-9           1.0.0 - 1.2.0     →  1.1.1\n[TITLE]  fake-package-10          \u003e2.1              →  2.2.2\n[TITLE]  fake-package-11          ^2 \u003c2.2 || \u003e 2.3  →  2.1.6\n[TITLE]  fake-package-12          ^2 \u003c2.2 || \u003e 2.3  →  2.4.2\n[TITLE]  fake-dev-package-1       ^4.0.0            →  4.0.0\n[TITLE]  fake-dev-package-2       ~5.0.0            →  5.0.0\n[TITLE]  fake-dev-package-3       6.x               →  6.0.0\n[TITLE]  fake-optional-package-1  ^7.0.0            →  7.0.0\n[TITLE]  fake-optional-package-2  ~8.0.0            →  8.0.0\n[TITLE]  fake-optional-package-3  9.x               →  9.0.0\n[TITLE]\n[TITLE] Run npd -d -u to upgrade package.json.\n[SUCCESS] Output dependency versions that can be pinned...\n[STARTED] Updating package.json...\n[SKIPPED] Update is disabled by default.\n[STARTED] Enabling save-exact using .npmrc...\n[SKIPPED] Enabling save-exact is disabled by default.\n[SUCCESS] Dependency versions that can be pinned:\n[SUCCESS]\n[SUCCESS]  fake-package-1           ^1.0.0            →  1.1.0\n[SUCCESS]  fake-package-2           ~2.5.0            →  2.5.2\n[SUCCESS]  fake-package-3           3.x               →  3.1.1\n[SUCCESS]  fake-package-4           ^0.0.3            →  0.0.3\n[SUCCESS]  fake-package-5           ~0.0.3            →  0.0.9\n[SUCCESS]  fake-package-6           ^0.1.0            →  0.1.0\n[SUCCESS]  fake-package-7           ~0.1.0            →  0.1.1\n[SUCCESS]  fake-package-9           1.0.0 - 1.2.0     →  1.1.1\n[SUCCESS]  fake-package-10          \u003e2.1              →  2.2.2\n[SUCCESS]  fake-package-11          ^2 \u003c2.2 || \u003e 2.3  →  2.1.6\n[SUCCESS]  fake-package-12          ^2 \u003c2.2 || \u003e 2.3  →  2.4.2\n[SUCCESS]  fake-dev-package-1       ^4.0.0            →  4.0.0\n[SUCCESS]  fake-dev-package-2       ~5.0.0            →  5.0.0\n[SUCCESS]  fake-dev-package-3       6.x               →  6.0.0\n[SUCCESS]  fake-optional-package-1  ^7.0.0            →  7.0.0\n[SUCCESS]  fake-optional-package-2  ~8.0.0            →  8.0.0\n[SUCCESS]  fake-optional-package-3  9.x               →  9.0.0\n[SUCCESS]\n[SUCCESS] Run npd -d -u to upgrade package.json.\n```\n\n\u003c/details\u003e\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmarlhens%2Fnpm-pin-dependencies","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsmarlhens%2Fnpm-pin-dependencies","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmarlhens%2Fnpm-pin-dependencies/lists"}