Package.json Version Range Cleaner

Pinning loose version ranges to exact versions

A package.json with react at ^18.2.0 (dependencies) and vite at ~5.0.0 (devDependencies) -- 2 dependencies total, named 'react, vite' -- converts to pinned exact versions: react becomes "18.2.0" and vite becomes "5.0.0", with the ^ and ~ range prefixes stripped entirely.

Pinning removes the ambiguity of range-based versions: with ^18.2.0, running npm install fresh at different times could install different actual React versions (18.2.0, 18.3.0, 18.9.0, anything under 19.0.0) depending on what's been published since -- an exact pin guarantees the same specific version installs every time, improving reproducibility.

The trade-off is that pinned dependencies won't automatically pick up patch or minor updates (including security fixes) on a fresh install the way a range would -- pinning trades automatic updates for predictability, which is a deliberate choice some teams make for production stability, while others prefer ranges specifically to get automatic patch updates.

What this cleaner reads, and what it leaves alone

Reads dependencies and devDependencies only. Nested lockfile trees are ignored. This processes the top-level dependencies and devDependencies fields in package.json -- it doesn't touch peerDependencies, optionalDependencies, or the actual resolved dependency tree recorded in a lockfile (package-lock.json or yarn.lock), which is a separate, more detailed record of every transitive dependency's exact resolved version.

Pinning package.json alone doesn't guarantee the same transitive dependencies install too -- a proper lockfile (already present in most projects) is what actually locks the full dependency tree, including nested dependencies of dependencies, which this tool doesn't generate or modify.

If your team already relies on committing a lockfile to version control (the standard practice for reproducible installs), pinning package.json directly is somewhat redundant for reproducibility, though it can still serve as clearer, more explicit documentation of exactly which versions are expected.

Related version and dependency tools

To check whether a specific package version satisfies a given semver range (useful before deciding whether pinning would even change behavior), the Semver Range Matcher answers that question directly.

Frequently Asked Questions (FAQ)