How to control dependency versions in Replit

When you run npm install express, npm adds it to package.json with a caret prefix like ^4.18.2. The caret means npm will install any version from 4.18.2 up to (but not including) 5.0.0. This is convenient for getting patches and minor updates, but it means running npm install tomorrow might give you a different version than today. For maximum stability, remove the caret and use exact versions like 4.18.2. You can also install with --save-exact to automatically pin the exact version.

1// package.json — Before (with version ranges)
2{
3  "dependencies": {
4    "express": "^4.18.2",
5    "pg": "~8.11.0",
6    "dotenv": "*"
7  }
8}
9
10// package.json — After (pinned exact versions)
11{
12  "dependencies": {
13    "express": "4.18.2",
14    "pg": "8.11.3",
15    "dotenv": "16.3.1"
16  }
17}

The lock file is even more important than pinning versions in package.json. While package.json declares what you want, the lock file records exactly what was installed, including every sub-dependency at its exact version. For npm this is package-lock.json, for pnpm it is pnpm-lock.yaml, for Python poetry it is poetry.lock. Always commit lock files to Git. When a collaborator or deployment runs npm install, it reads the lock file and installs exactly the same versions you used.

1# Commit the lock file to Git
2git add package-lock.json
3git commit -m "Add package-lock.json for reproducible builds"
4
5# For Python with pip:
6pip freeze > requirements.txt
7git add requirements.txt
8git commit -m "Pin Python dependency versions"

Python's pip install uses version ranges by default, similar to npm. After installing all your packages, run pip freeze to output every installed package with its exact version. Redirect this output to requirements.txt. Now pip install -r requirements.txt will install those exact versions. For more sophisticated dependency management, use Poetry, which generates a poetry.lock file automatically and handles dependency resolution.

1# Install packages
2pip install flask requests beautifulsoup4
3
4# Freeze current versions to requirements.txt
5pip freeze > requirements.txt
6
7# The output looks like:
8# Flask==3.0.0
9# requests==2.31.0
10# beautifulsoup4==4.12.2
11# ... (plus all sub-dependencies)
12
13# Install exact versions from file:
14pip install -r requirements.txt

System-level packages in Replit are managed through Nix channels configured in the .replit file. Each channel is a snapshot of the Nixpkgs repository at a specific point in time. Setting a specific channel like stable-24_05 ensures that your Node.js, Python, or Go runtime stays at the same version even if Replit updates its defaults. Without this, Replit may upgrade your Nix channel automatically, potentially changing your runtime version.

1# In .replit file:
2[nix]
3channel = "stable-24_05"

The npm ci command is designed for automated environments and deployments. Unlike npm install, which may modify the lock file, npm ci deletes the existing node_modules folder and installs exactly what the lock file specifies. If the lock file is out of sync with package.json, npm ci fails instead of silently resolving the difference. Use npm ci in your deployment build command to guarantee reproducible builds.

1# In .replit [deployment] section:
2[deployment]
3build = ["npm", "ci", "&&", "npm", "run", "build"]
4run = ["node", "dist/index.js"]
5deploymentTarget = "cloudrun"

Periodically review your dependencies for security vulnerabilities and outdated versions. Run npm audit to check for known vulnerabilities and npm outdated to see which packages have newer versions available. Update one package at a time and test after each update. Run npm update to apply minor and patch updates within your specified ranges, then run your tests to verify nothing breaks.

1# Check for security vulnerabilities
2npm audit
3
4# See which packages have newer versions
5npm outdated
6
7# Update a specific package
8npm install express@latest --save-exact
9
10# Run tests after updating
11npm test
12
13# For Python:
14pip list --outdated
15pip install --upgrade flask