difference between "install" & "update" git dependencies

[stemail23]

npm version 1.4.24

I have a dependency in my package.json of the format

"MODULE": "git+https://USERNAME:PASSWORD@github.com/ORG/MODULE#v1.0.0"

When I try to execute

npm install MODULE

I'm prompted to enter the github username and password, despite the fact that they're in the dependency path. Weirdly, if I run

npm update MODULE

The dependency installs correctly without prompting for the github credentials!

[stemail23]

OK, so this took me a while to track down, but it ended up being about a shrinkwrap file which was effectively caching the url in the package. Nasty.

[iarna]

This behavior does seem off to me– github URL there should ONLY come from the shrinkwrap.json if one is present.

[stemail23]

If there is a URL in the shrinkwrap, it overrides whatever's in package.json for "install". My problem was that I hadn't re-shrinkwrapped after I'd updated my package.json. "update" always looks at package.json, and the shrinkwrap is ignored. It all makes sense to me now, but until it clicked, I was very confused!

[npm-robot]

We're closing this issue as it has gone thirty days without activity. In our experience if an issue has gone thirty days without any activity then it's unlikely to be addressed. In the case of bug reports, often the underlying issue will be addressed but finding related issues is quite difficult and often incomplete.

If this was a bug report and it is still relevant then we encourage you to open it again as a new issue. If this was a feature request then you should feel free to open it again, or even better open a PR.

For more information about our new issue aging policies and why we've instituted them please see our blog post.