Absolutely. Using shrinkwrap doesn't mean you should defer updating dependencies for weeks or months, but I've wasted enough time dealing with issues caused by

Absolutely. Using shrinkwrap doesn't mean you should defer updating dependencies for weeks or months, but I've wasted enough time dealing with issues caused by minor differences in people's node_modules and things randomly breaking that I refuse to not use shrinkwrap. Advantages: 1. Ensures everyone is developing on the exact same versions of every package 2. We have a complete record of correctly working dependencies' versions in the source tree at all times 3. Some random package developer can't introduce a bug in my software by pushing a new buggy version of their package right before I cut a release Disadvantages: 1. You may not get bug fixes immediately. Solution: do a fresh `npm install` and `npm shrinkwrap` regularly (but not in the middle of testing a release branch, for example) 2. If someone unpublishes a version depend on you have to drop what you're doing and fix your npm-shrinkwrap.json Also, `npm deprecate` allows package maintainers to deprecate specific versions (e.x. if a vulnerability is found), and you'll get a warning when installing, even if you use shrinkwrap. I'm not sure how common it's usage is though.