Pinning a Bower Dependency to a Specific Git Tag or Commit

Desired outcome

Ensure a front‑end dependency installed via Bower is fixed to a known Git tag or commit so that subsequent builds retrieve the exact same source, preventing unexpected updates or breaking changes.

Prerequisites

• Node.js installed (any version that still supports the global Bower package; e.g., Node 12‑14 works with Bower 1.8.x).
• Bower installed globally: npm install -g bower (requires permission to write to the global npm directory; use sudo on Linux/macOS if needed).
• An existing project with a bower.json file.
• Git available in the PATH for fetching remote repositories.

Procedure

1. Identify the target reference. Decide whether you want to lock to a tag (e.g., v3.5.1) or a specific commit hash (e.g., a1b2c3d4e5f6...). You can list tags with git ls-remote --tags or view commits with git ls-remote --heads .
2. Edit bower.json. Locate the dependency entry and replace its value with a Git URL followed by # and the reference.

   {
     "name": "my-project",
     "dependencies": {
       "jquery": "git://github.com/jquery/jquery.git#3.5.1",
       "lodash": "git://github.com/lodash/lodash.git#a1b2c3d4e5f6g7h8i9j0"
     }
   }

   If the package is already registered in the Bower registry, you can also use the shorthand jquery#3.5.1.

3. Install or reinstall the dependency. Run the command in the project directory:

   bower install

   This will fetch the specified Git reference and place the files under bower_components/<package-name>/.

4. Verify the installed reference. Navigate to the component’s directory and check the Git HEAD:

   cd bower_components/jquery
    git rev-parse HEAD

   The output should match the commit hash associated with the tag or commit you specified. You can also run bower list to see a tree of installed packages and their sources.

Expected checks

• bower list shows each dependency with the exact Git reference you set (e.g., jquery#3.5.1).
• The git rev-parse HEAD command inside each component returns a hash that matches the tag/commit you locked to.
• Building your project (e.g., running your usual gulp/webpack task) completes without errors, confirming the assets are usable.

Recovery options (rollback)

If you need to revert to a previously floating version:

1. Edit bower.json and change the dependency back to a version range, a different tag, or remove the # suffix to let Bower pick the latest.
2. Run bower install again to fetch the new version.
3. Optionally clean the Bower cache to avoid using stale data: bower cache clean.

Limitations and practical notes

• Bower is unmaintained; compatibility with newer Node.js versions may require using an older Node release or setting --allow-root on CI systems.
• The Git reference method works only for dependencies sourced from a Git URL or a Bower‑registered package that maps to a Git repo. It does not work with plain ZIP URLs.
• Because Bower does not generate a lockfile, you must manually commit the updated bower.json to version control to ensure reproducibility across environments.
• Security advisories for Bower are sparse; verify that the Git reference points to a reputable repository and consider monitoring the upstream project for vulnerabilities.

Quick example

Suppose you want to lock the Bootstrap library to the v4.6.2 tag:

{
  "name": "my-app",
  "dependencies": {
    "bootstrap": "git://github.com/twbs/bootstrap.git#v4.6.2"
  }
}

Run bower install, then check:

cd bower_components/bootstrap
 git rev-parse HEAD
 # Expected: hash matching tag v4.6.2

If the hash matches, your build will always receive Bootstrap 4.6.2 regardless of newer releases published to the Bower registry.