You're still allowed to use lockfiles and shrinkwraps. Anyone deploying an application to a server or distributing an application to end users should have the

You're still allowed to use lockfiles and shrinkwraps. Anyone deploying an application to a server or distributing an application to end users should have the dependencies shrinkwrapped and the application tested with them. Upgrading dependencies to get bug and security fixes in minor and point releases is as easy as deleting the shrinkwrap, installing the dependencies again, and making a new shrinkwrap. Then you put your application through all of its tests with the new dependencies, commit the new shrinkwrap, and then you can release/deploy a new version of the application.