DL3016.md

Pattern: Missing version pinning for npm

Issue: -

Description

Version pinning forces the build to retrieve a particular version regardless of what’s in the cache. This technique can also reduce failures due to unanticipated changes in required packages.

Example of incorrect code:

RUN npm install express
RUN npm install @myorg/privatepackage
RUN npm install express sax@0.1.1
RUN npm install --global express

Example of correct code:

RUN npm install express@4.1.1
RUN npm install @myorg/privatepackage@">=0.1.0"
RUN npm install express@"4.1.1" sax@0.1.1
RUN npm install --global express@"4.1.1"

Exceptions

Pin your versions in package.json and run npm install with no arguments.

Further Reading

• Hadolint - DL3016
• Best practices for writing Dockerfiles - RUN