Shrinkwrap npm dependencies

npm-shrinkwrap should be used to lock down dependency versions.

To lock all npm dependencies (including dev ones) we can use:

npm shrinkwrap --dev

This will generate a npm-shrinkwrap.json file which should be add to version control.

Once dependencies are shrinkwrapped issuing

npm install

will install the locked versions of the dependencies.

To add or update dependencies we use

npm install --save <package>

thus updating both package.json and npm-shrinkwrap.json.

npm-outdated allows a quick overview of dependencies with newer versions available.