Run npm update and npm install on CircleCI

[lucaswoj]

Because CircleCI uses a cached node_modules folder and never runs npm update, it doesn't grab the latest versions of dependencies. This PR causes CircleCI to run npm update alongside npm install on every build.

Is this approach preferable to using shrinkwrap #1607?

fixes #1600

cc @jfirebaugh @tmcw @mourner

[lucaswoj]

The npm update command seems to work, although the build log has lots of warnings about undefined version #s. I'm not sure what to make of that as I have never seen those messages locally.

Maybe deleting the cached node_modules folder once will help?

[jfirebaugh]

Are both update and install required? The docs say update "will also install missing packages".

[lucaswoj]

Correct. The one difference is that npm update doesn't run any of the package.json scripts (preinstall, postinstall, prepublish).

[lucaswoj]

We're not using any of those scripts right now but disabling them feels like a big "gotcha" waiting to happen. Not sure how to weigh that cost against the increased build time.

[jfirebaugh]

I don't have a strong gut feeling on npm update vs shrinkwrap. I think shrinkwrap solves a theoretical problem but has more unknowns.

[lucaswoj]

My gut feeling is that we should try the npm update solution for now and move to shrinkwrap if/when we hit more pain points.

[lucaswoj]

On further thought, lets skip npm install and just run npm update.

"job security"

[lucaswoj]

Ok. I think the latest iteration gets it right. We run npm update and trigger all the scripts manually.

🚢 @jfirebaugh?

[jfirebaugh]

👍

[lucaswoj]

Merged in 9db3c0a