npm-shrinkwrap

It exists (npm shrinkwrap [1]), but it's not enabled by default, and it has some warts, such as non-deterministic sorting of entries. There's a third-party tool [2] that is supposed to solve many of the issues, but I haven't tried it. Of course, if you do this, there's a decent chance that if you try installing it again in 6 months, your shrinkwrapped version of at least one of the dependencies won't be available any more... [1]: https://docs.npmjs.com/cli/shrinkwrap [2]: https://github.com/uber/npm-shrinkwrap

I've run in to so many npm errors over the past couple weeks, some due to npm bugs, some due to buggy packages, that I'm not very confident in npm or the package ecosystem any more. First of all, most people don't actually follow semantic versioning, but npm's default version ranges assume they do, so unless you lock down your dependencies with `npm shrinkwrap` you'll find your app occasionally breaks because some deeply nested dependency broke something in some package you don't know anything about. But shrinkwrap has a bunch of problems itself (so many that Uber wrote a separate tool to try to fix it: https://github.com/uber/npm-shrinkwrap). npm-shrinkwrap.json files are huge, in part due to the nature of npm, but it also contains a bunch of unnecessary information. The bigger problem is it's non-deterministic, resulting in huge diffs e

I agree shrinkwrap is necessary, and should probably be a more standard part of the npm workflow, but it's kind of annoying to use in practice. For one it generates huge files. Like 750KB on a project with a couple dozen dependencies: https://github.com/metabase/metabase/blob/master/npm-shrinkw... Secondly, it's not deterministic and will generate huge diffs every time you run it even if nothing changes. Uber has a tool called npm-shrinkwrap that in theory is supposed to solve the latter, but I've never gotten it working on my current projects: https://github.com/uber/npm-shrinkwrap

Try https://github.com/uber/npm-shrinkwrap, it produces deterministic shrinkwrap files that actually diff properly.