NPM-SHRINKWRAP.JSON(5)

👑 npm-shrinkwrap.json(5)

okay bestie, welcome to the manual page for npm-shrinkwrap.json — yes that's the "5" one, the file-format girly, not a command. she's a whole vibe and she's here to be explained. 💅

---

✨ NAME ✨

npm-shrinkwrap.json — a publishable lockfile 🎀

---

🌸 DESCRIPTION 🌸

so npm-shrinkwrap.json is a file that gets created by npm help shrinkwrap. that's her origin story. ✨

she is identical to package-lock.json, with one major caveat, and the caveat is literally the whole personality:

unlike package-lock.json, npm-shrinkwrap.json may be included when publishing a package. 😭💖

like, that's it. that's the difference. one file gets shipped to the registry, the other one stays home. iykyk.

---

🦋 the recommended use-case (aka when to actually use her)

the recommended use-case for npm-shrinkwrap.json is applications deployed through the publishing process on the registry — for example:

• daemons 🧚
• command-line tools intended as global installs
• devDependencies

basically: things you ship and want to lock down hard. no cap.

---

💀 the warning, and it's a real one

it's strongly discouraged for library authors to publish this file. like, please don't. 🙈

why? because publishing it would prevent end users from having control over transitive dependency updates. so if you're a library author and you ship this, you're basically picking your users' dependencies for them and that's not the main character energy you want. be respectful of their autonomy, periodt. 👑

---

⭐ the tiebreaker rule

additionally, if both package-lock.json and npm-shrinkwrap.json are present in a package root, then package-lock.json will be ignored in favor of this file. 🫶

so npm-shrinkwrap.json wins. she ate. 💅

---

🔥 where to read the full lore

for full details and description of the npm-shrinkwrap.json file format, refer to the manual page for:

npm help 5 package-lock.json

yes queen, go read her sister's page. the format deets live there. 🌈

---

🎀 SEE ALSO 🎀

• npm help shrinkwrap
• npm help 5 package-lock.json
• npm help 5 package.json
• npm help install

---

that's the whole page bestie, go forth and lock your deps responsibly 💜

tiny sign-off: this was NPM-SHRINKWRAP.JSON(5), dated May 2018 — yes she's an old icon but she's still serving. mwah. 💖✨