How can I forcibly exclude a nested dependency for NPM?

When managing project dependencies with NPM, you may encounter situations where you need to exclude or replace certain specific nested dependencies (i.e., child dependencies). This typically occurs due to security issues, licensing problems, or conflicts with other parts of the project. Below, I will introduce several methods to forcibly exclude nested dependencies, along with relevant examples.

1. Using the resolutions Field (Yarn)

First, although this is a Yarn feature rather than an NPM one, it is a very popular and effective method for handling nested dependencies.

In the project's package.json file, you can add a resolutions field to specify the version to override.

For example, if you need to override the version of lodash, you can write:

json
{
  "resolutions": {
    "lodash": "4.17.21"
  }
}

This ensures that regardless of which package in the dependency tree requests lodash, the installed version will be 4.17.21.

2. Using the npm-force-resolutions Script

For NPM users, you can use the third-party tool npm-force-resolutions to emulate the resolutions functionality of Yarn. First, declare the dependencies to be forcibly resolved in package.json, then run a pre-install script.

json
{
  "scripts": {
    "preinstall": "npx npm-force-resolutions"
  },
  "resolutions": {
    "lodash": "4.17.21"
  }
}

Before running npm install, the preinstall script will execute first, and npm-force-resolutions will adjust package-lock.json to reflect the versions specified in resolutions.

3. Manually Editing package-lock.json

Although this method is somewhat primitive and not recommended for automated development workflows, it can be a viable approach in situations requiring quick fixes. You can directly locate the relevant dependency and modify its version number. However, you must preserve these changes when running npm install afterward, as they may otherwise be overwritten.

For example, change the version of lodash in package-lock.json to 4.17.21.

4. Using the overrides Field (Supported from npm v8.3.0)

The latest version of npm introduces the overrides feature, which is similar to Yarn's resolutions but more flexible and powerful.

json
{
  "overrides": {
    "lodash": "4.17.21"
  }
}

This ensures that any nested dependency requesting lodash will use version 4.17.21.

Summary

These are several methods to manage and forcibly exclude nested dependencies in NPM. The choice of method depends on your specific requirements and the version of npm you are using. In practice, it is recommended to use overrides or npm-force-resolutions as these methods are more official and standardized. However, if you are using Yarn, using resolutions is also an excellent choice.