npm-force-resolutions: Force dependency versions

npm-force-resolutions modifies your package-lock.json to enforce specific versions of transitive dependencies. It provides a way to override dependency resolutions, similar to Yarn's selective dependency resolutions, without switching package managers. The package aims to address situations where outdated or vulnerable versions of sub-dependencies cause security risks.

This package offers a simple solution for forcing specific versions of transitive dependencies. Its lightweight design minimizes overhead during the installation process. The direct modification of package-lock.json ensures consistent dependency versions across environments.

• Version Locking: Enforces specific versions of transitive dependencies as defined in package.json's resolutions field.
• Preinstall Script: Integrates seamlessly into the preinstall script for automated version enforcement.
• Package-lock.json Modification: Modifies only the package-lock.json file, avoiding unnecessary changes to package.json.
• Security Focus: Primarily designed to address security vulnerabilities associated with outdated dependencies.
• Easy to Use: Simple configuration via the resolutions field in package.json.
• Compatibility: Compatible with standard npm workflows and dependency management practices.
• Version Verification: Facilitates verification of installed dependency versions using npm ls.

The project has been maintained since 2018 and has a moderate level of activity, with occasional releases. The issue tracker shows responsive attention to reported problems. While not actively developed, it provides a reliable solution for force-resolving dependencies. Documentation is minimal but provides sufficient information for basic usage.

npm-force-resolutions is beneficial for developers who need to ensure consistent and secure dependency versions within their projects, particularly when addressing vulnerabilities. It enables targeted dependency updates without requiring a full dependency graph overhaul or migration to a different package manager. The tool provides control over transitive dependencies, enhancing project stability.