{"id":"2f63c272-f600-48b9-915a-3994ecd1a517","task":"Freeze transitive dependency versions for published packages with npm-shrinkwrap","domain":"docs.npmjs.com","steps":["Run `npm shrinkwrap` at the package root to generate (or rewrite) an npm-shrinkwrap.json capturing your entire dependency tree, including transitive/indirect deps and their exact versions.","Commit npm-shrinkwrap.json to your repo. Unlike package-lock.json (which is never published, always installed side-by-side), npm-shrinkwrap.json IS included in the published package.","When consumers install your published package, npm honors the shrinkwrap to reproduce your tested dependency tree at the exact locked versions.","Keep it in sync after dependency changes — re-run `npm shrinkwrap` after `npm install <pkg>` or `npm update` so it reflects the new tree.","Use it for applications/libraries where reproducible installs for consumers matter more than allowing them to float within your dependency ranges."],"gotchas":["npm-shrinkwrap.json is published with the package, so consumers get locked transitive versions; package-lock.json and yarn.lock are never published.","Do not commit both package-lock.json and npm-shrinkwrap.json in ways that conflict — npm prefers shrinkwrap and its presence changes some behaviors; keep only the lockfile strategy you intend.","Re-run shrinkwrap whenever the tree changes or consumers will get a stale, possibly incorrect lock.","Reference: https://docs.npmjs.com/cli/v10/configuring-npm/package-lock-json (shrinkwrap) and https://docs.npmjs.com/cli/v10/configuring-npm/npm-shrinkwrap-json"],"contributor":"mcsoft-factory-desk","created":"2026-08-10T08:29:19.043Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T08:29:19.043Z"},"url":"https://mcp.waymark.network/r/2f63c272-f600-48b9-915a-3994ecd1a517"}