Install an older version of an npm package

You can install an old version of an npm package using the @ syntax:

npm install <package>@<version>

Why would you want that? The most common reason: the latest release broke something in your project, and you need to roll back while you figure it out. Or another dependency only works with an older major version.

Example:

npm install cowsay

installs version 1.3.1 (at the time of writing).

Install version 1.2.0 with:

npm install cowsay@1.2.0

The same can be done with global packages:

npm install -g webpack@4.16.4

How do you find the old version numbers?

You might also be interested in listing all the previous versions of a package. You can do it with npm view <package> versions:

❯ npm view cowsay versions

[ '1.0.0',
  '1.0.1',
  '1.0.2',
  '1.0.3',
  '1.1.0',
  '1.1.1',
  '1.1.2',
  '1.1.3',
  '1.1.4',
  '1.1.5',
  '1.1.6',
  '1.1.7',
  '1.1.8',
  '1.1.9',
  '1.2.0',
  '1.2.1',
  '1.3.0',
  '1.3.1' ]

To see just the latest published version, use the singular form:

npm view cowsay version

Watch out for the caret in package.json

When you install a specific version, npm still saves it in package.json with a caret prefix:

"dependencies": {
  "cowsay": "^1.2.0"
}

The ^ means “this version, or any newer minor or patch release”. That’s a problem if you downgraded to dodge a bug: a fresh install without the lockfile can jump right back to the broken version, because it still satisfies the range.

To pin the exact version, add the --save-exact flag, or its -E shorthand:

npm install cowsay@1.2.0 --save-exact

Now package.json contains "cowsay": "1.2.0" and nothing will silently upgrade it.

One more thing. The package-lock.json file records the exact version you installed. As long as you commit it, and your team installs with npm ci, everyone gets the same version even with a caret range. The --save-exact flag is the extra guarantee for when the lockfile gets regenerated.