# NPM // :toc: // Set toclevels to be at least your hugo [markup.tableOfContents.endLevel] config key :toclevels: 4 [cols="1^,1^,1^",options=header] |=== | source | condition | target | ✔ | ✔ | ✗ |=== == Description The `npm` resource queries an npm registry for the versions of a package. **source**:: Returns the version of the package matching `versionfilter`. **condition**:: Checks that `version` is published for the package. **target**:: Not supported - a registry is not something Updatecli publishes to. A target fails with `Target not supported for the plugin Npm`. To bump a dependency *in a file*, use the link:/docs/plugins/resource/json/["JSON" resource] against `package.json`, or the link:/docs/plugins/autodiscovery/npm/[npm autodiscovery crawler]. NOTE: An `scm` attached to a condition is ignored, with a warning (the lookup always goes to the registry). == Parameters {{< resourceparameters "sources" "npm" >}} `name`:: The package name, scope included: `@updatecli/updatecli` as well as `express`. `url`:: Defaults to `https://registry.npmjs.org/`. `version`:: Condition only - the version whose existence is being checked. == Version selection `versionfilter` behaves differently here than on most resources: with `kind: latest`, the value is taken from the registry's own `dist-tags.latest`, which is what `npm install ` would give you (*not* the highest version number). Every other filter kind sorts the full version list and applies the pattern. That distinction matters for packages that publish patches for older majors after a new major: `latest` follows the maintainer's tag, `semver` follows the numbering. See the link:/docs/core/versionfilter/["Version Filtering" page]. == Authentication Private registries are reached in one of two ways. `registrytoken` sets the bearer token directly, keep it out of the manifest: [source,yaml] ---- spec: name: "@acme/widget" url: "https://npm.acme.example.com" registrytoken: '{{ requiredEnv "NPM_TOKEN" }}' ---- `npmrcpath` points at an `.npmrc` file instead. Its handling has a fallback worth knowing about: [IMPORTANT] ==== When `npmrcpath` is empty *or the file it names does not exist*, Updatecli falls back to `$HOME/.npmrc`. A typo in the path therefore does not raise an error (it silently reads the user's own configuration, which is easy to miss when it works locally and fails in CI where that file is absent). ==== From an `.npmrc`, Updatecli reads two kinds of entry: * `//registry.example.com/:_authToken=xxx` - a token per registry * `@scope:registry=https://registry.example.com` - a registry per scope == Example [source,yaml] ---- # updatecli.yaml {{}} ---- == Links * link:https://docs.npmjs.com/cli/v10/configuring-npm/npmrc[npmrc reference] * link:/docs/core/versionfilter/["Version Filtering" page]