A consistent shrinkwrap tool for npm that verifies package.json and node_modules sync, cleans up shrinkwrap files, and provides readable diffs.
npm-shrinkwrap is a Node.js tool that enhances npm's native shrinkwrap functionality by ensuring consistency between package.json, npm-shrinkwrap.json, and the node_modules directory. It verifies git tags, normalizes shrinkwrap output to reduce diff noise, and provides human-readable diffs for dependency changes. The tool solves issues where manual edits or unsynced installations cause dependency mismatches.
Node.js developers and teams managing projects with locked dependencies using npm shrinkwrap, particularly those needing reliable git tag validation and clean, maintainable shrinkwrap files.
Developers choose npm-shrinkwrap over standard npm shrinkwrap for its rigorous verification of dependency consistency, reduction of unnecessary diff churn in version control, and customizable validation rules, leading to more reliable and maintainable dependency locks.
A consistent shrinkwrap tool
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Addresses npm's blind spot by validating that git dependencies in package.json match those in node_modules, specifically for tags. README notes: 'npm happily says that the dependency in your node_modules tree is valid regardless of what tag it is.'
Ensures every package in the shrinkwrap file has a 'resolved' field, eliminating inconsistencies caused by npm cache state. README states: 'npm-shrinkwrap will put a resolved field in for everything in your shrinkwrap.'
Removes unnecessary 'from' fields and sorts shrinkwrap files deterministically to minimize unreadable git diffs. README explains: 'trimFrom() also sorts and rewrites the package.json for consistency.'
Provides a 'diff' command to display shrinkwrap changes in a clear, context-specific format, making dependency updates easier to review. README includes examples like 'npm-shrinkwrap diff master HEAD'.
The project is explicitly marked as deprecated and not maintained, posing significant risks for long-term use and security. README opens with: '(This project is deprecated and not maintained.)'
Only supports npm versions below 3, making it incompatible with modern npm installations and features like package-lock.json. README warns: 'Note: npm >= 3 is currently not supported.'
Involves multiple steps like verifyGit, trimFrom, and sync, which can be cumbersome and error-prone compared to standard npm commands. README describes an intricate algorithm with depth limitations and warnings for non-git tags.