Skip to content
Latchkey

npm install: Flags That Matter in CI

npm install is the general-purpose installer; in CI you usually want npm ci instead.

npm install can mutate package-lock.json, which makes CI non-reproducible. When you must use it, pin behavior with explicit flags.

Common flags

  • --save-exact - pin exact versions
  • --no-save - do not edit package.json
  • --legacy-peer-deps - relax peer resolution
  • --omit=dev - skip devDependencies

Example in CI

Install a single tool without touching manifests.

shell
npm install --no-save --no-audit npm-run-all

In CI

Prefer npm ci for the main install. Reach for npm install only for ad-hoc tooling. --legacy-peer-deps is a common escape hatch for ERESOLVE.

Key takeaways

  • npm install can rewrite the lockfile.
  • Use npm ci for reproducible builds.
  • --legacy-peer-deps works around ERESOLVE.

Related guides

npm ci: Clean, Reproducible Installsnpm ci installs exactly what is in package-lock.json, deletes node_modules first, and is the right install co… npm dedupe: Flatten Duplicate Depsnpm dedupe simplifies the dependency tree by sharing compatible versions, reducing install size and duplicate…
Tired of flaky CI? Latchkey auto-heals failed jobs and retries them for you. Start free →