npm CLI hits 7.0.0 after a major internal rewrite

Eleven years after npm arrived to give the JavaScript community a package manager, the project is shipping its first major release since npm 6. npm v7.0.0 is available now via npm i -g npm@7 and will also be bundled with Node.js 15.0.0 when that ships next week.

Three headline features

npm 7 introduces a handful of long-awaited workflow changes. Workspaces lets developers manage multiple packages from within a single top-level root package, which is useful for monorepo setups. The CLI now also auto-installs peer dependencies: previously developers had to resolve and install those themselves, but the new peer dependency algorithm looks for a valid match at or above the peer-dependent's location in the node_modules tree.

The third major addition is a new package-lock v2 format, which records everything npm needs to fully build the package tree and supports deterministically reproducible builds. In a smaller but useful change, npm will no longer ignore yarn.lock files; it can use them as a source of package metadata and resolution guidance.

The refactor underneath

The internals of npm have been substantially reorganized with an eye toward separating concerns. Inspection and management of the node_modules tree, for instance, has moved into its own module called Arborist. The goal is a codebase that is easier to maintain and more reliable over time, which should translate to fewer bugs and a faster iteration cycle for future updates.

The team also ran npm 7.0.0 through the Node.js smoke-testing suite CITGM, testing it against more than 120 heavily relied-upon modules. Despite the scale of the internal changes, no new modules are failing under npm 7 compared with npm 6.

What breaks

The maintainers say they worked to keep disruptions minimal, but some breaking changes were necessary. Peer dependencies are now installed automatically, which could trip up certain workflows that previously managed them by hand. npm has also switched to using the package.exports field, meaning internal modules can no longer be pulled in via require().

npx has been rewritten as the npm exec command, bringing functional changes—most noticeably a prompt when the module you're trying to run is not yet installed. The output of npm audit has also changed significantly in both its human-readable and --json styles.

A gradual rollout

npm 7.0.0 will not be marked as latest. Existing workflows won't pick it up by default; you have to opt in by running npm install -g npm@7 or by installing Node.js 15. The team plans to watch real-world usage and collect feedback before publishing the release line as latest, which will happen when they're confident it's ready to be included in a Node.js LTS release.

Future work includes improvements to workspaces and package overrides, with feature proposals tracked in the npm RFC repository.