I agree shrinkwrap is necessary, and should probably be a more standard part of the npm workflow, but it's kind of annoying to use in practice. For one it gene

I agree shrinkwrap is necessary, and should probably be a more standard part of the npm workflow, but it's kind of annoying to use in practice. For one it generates huge files. Like 750KB on a project with a couple dozen dependencies: https://github.com/metabase/metabase/blob/master/npm-shrinkwrap.json https://github.com/metabase/metabase/blob/master/npm-shrinkw... Secondly, it's not deterministic and will generate huge diffs every time you run it even if nothing changes. Uber has a tool called npm-shrinkwrap that in theory is supposed to solve the latter, but I've never gotten it working on my current projects: https://github.com/uber/npm-shrinkwrap https://github.com/uber/npm-shrinkwrap