Why does npm install with git+ssh install differently than https?

Question

What is the difference between installing a npm package via https and ssh? My expectation is that the downloaded package would be the same but this is not the case. For example:

// package.json
"dependencies": {
    "lodash": "^4.17.19"
    // vs
    "lodash": "[email protected]:lodash/lodash.git#semver:^4.17.19"
}

When I use the first option, the actual npm package gets installed. When I install via the second option, I get only the files that are whitelisted from the repo but not the actual package itself.

I don't see a good explanation in the npm documentation. Why aren't these installing the same thing? Is there a way to install the actual package via ssh and not the commit itself?

Charlie · Accepted Answer · 2020-07-22 16:34:22Z

1

Two ways of installing dependencies.

From NPM repository itself (specify the version)
From github (specify a branch OR commit and tag)

It is advisable to publish to the registry the minified/compiled version of the library than the source unless it is necessary. So, it is possible that what you get from the NPM is different than the source repository itself.

It is really question of the "place" (npm or github) than the method (http or ssh)

answered Jul 22, 2020 at 16:34

Charlie

24k12 gold badges65 silver badges96 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

MonkBen Over a year ago

This makes sense. So the git+ssh will obviously only pull from git then.

Charlie Over a year ago

Yes - a related post stackoverflow.com/questions/23210437/…

Collectives™ on Stack Overflow

Why does npm install with git+ssh install differently than https?

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related