npm update --save in [email protected] does not respect exact versions

[matthewmayer]

npm update --save in [email protected] works differently to npm update in npm@6 when specifying an exact version

For example if you run npm install --save-exact [email protected]

Then your package.json will look like this:

"cron": "1.8.0"

if you then run on npm@6
npm update

nothing is changed

but if you then run on [email protected]

npm update --save

package.json is updated to

"cron": "^1.8.0"

and then if you run npm update --save again package.json is updated to

"cron": "^1.8.2"

This is doubly confusing as my pinned version is lost AND I get a different behavior if I run npm update twice

Originally posted by @matthewmayer in #2704 (comment)

[ruyadorno]

thanks for the report @matthewmayer that's def unintended behavior!

I can easily reproduce it with a minimal example:

$ npm i --save-exact [email protected]
$ cat package.json
{
  "name": "test-save-exact",
  "version": "1.0.0",
  "dependencies": {
    "abbrev": "1.0.9"
  }
}

$ npm up --save
$ cat package.json
{
  "name": "test-save-exact",
  "version": "1.0.0",
  "dependencies": {
    "abbrev": "^1.0.9"
  }
}

$ npm up --save
$ cat package.json
{
  "name": "test-save-exact",
  "version": "1.0.0",
  "dependencies": {
    "abbrev": "^1.1.1"
  }
}