feat!: drop npm-shrinkwrap.json support · npm/cli@2e5dcad · GitHub
Skip to content

Commit 2e5dcad

Browse files
owlstronautowlstronaut
committed
feat!: drop npm-shrinkwrap.json support
BREAKING CHANGE: `npm shrinkwrap` is removed, the `shrinkwrap` config alias is removed, and `npm-shrinkwrap.json` is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root `npm-shrinkwrap.json` to `package-lock.json`; use `bundleDependencies` if you need to ship a locked dependency tree.
1 parent 2397196 commit 2e5dcad

143 files changed

Lines changed: 235 additions & 7162 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎docs/lib/build.js‎

Lines changed: 0 additions & 1 deletion

‎docs/lib/content/commands/npm-audit.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ This option does not filter the report output, it simply changes the command's f
2525

2626
### Package lock
2727

28-
By default npm requires a package-lock or shrinkwrap in order to run the audit.
28+
By default npm requires a package-lock in order to run the audit.
2929
You can bypass the package lock with `--no-package-lock` but be aware the results may be different with every run, since npm will re-build the dependency tree each time.
3030

3131
### Audit Signatures

‎docs/lib/content/commands/npm-ci.md‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,12 @@ This command is similar to [`npm install`](/commands/npm-install), except it's m
1414

1515
The main differences between using `npm install` and `npm ci` are:
1616

17-
* The project **must** have an existing `package-lock.json` or
18-
`npm-shrinkwrap.json`.
17+
* The project **must** have an existing `package-lock.json`.
1918
* If dependencies in the package lock do not match those in `package.json`,
2019
`npm ci` will exit with an error, instead of updating the package lock.
2120
* `npm ci` can only install entire projects at a time: individual dependencies cannot be added with this command.
2221
* If a `node_modules` is already present, it will be automatically removed before `npm ci` begins its install.
23-
* It will never write to `package.json` or any of the package-locks:
22+
* It will never write to `package.json` or `package-lock.json`:
2423
installs are essentially frozen.
2524

2625
NOTE: If you create your `package-lock.json` file by running `npm install` with flags that can affect the shape of your dependency tree, such as

‎docs/lib/content/commands/npm-install.md‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,12 @@ description: Install a package
1111
### Description
1212

1313
This command installs a package and any packages that it depends on.
14-
If the package has a package-lock, or an npm shrinkwrap file, or a yarn lock file, the installation of dependencies will be driven by that, respecting the following order of precedence:
14+
If the package has a package-lock or a yarn lock file, the installation of dependencies will be driven by that, respecting the following order of precedence:
1515

16-
* `npm-shrinkwrap.json`
1716
* `package-lock.json`
1817
* `yarn.lock`
1918

20-
See [package-lock.json](/configuring-npm/package-lock-json) and [`npm shrinkwrap`](/commands/npm-shrinkwrap).
19+
See [package-lock.json](/configuring-npm/package-lock-json).
2120

2221
#### How `npm install` uses `package-lock.json`
2322

@@ -136,7 +135,7 @@ Even if you never publish your package, you can still get a lot of benefits of u
136135
137136
* `-B, --save-bundle`: Saved dependencies will also be added to your `bundleDependencies` list.
138137
139-
Further, if you have an `npm-shrinkwrap.json` or `package-lock.json` then it will be updated as well.
138+
Further, if you have a `package-lock.json` then it will be updated as well.
140139
141140
`<scope>` is optional.
142141
The package will be downloaded from the registry associated with the specified scope.
@@ -402,6 +401,5 @@ See [folders](/configuring-npm/folders) for a more detailed description of the s
402401
* [npm registry](/using-npm/registry)
403402
* [npm dist-tag](/commands/npm-dist-tag)
404403
* [npm uninstall](/commands/npm-uninstall)
405-
* [npm shrinkwrap](/commands/npm-shrinkwrap)
406404
* [package.json](/configuring-npm/package-json)
407405
* [workspaces](/using-npm/workspaces)

‎docs/lib/content/commands/npm-query.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ $ npm query ':root>:outdated(in-range).prod' --no-expect-results
152152

153153
### Package lock only mode
154154

155-
If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded.
155+
If package-lock-only is enabled, only the information in the package lock is loaded.
156156
This means that information from the package.json files of your dependencies will not be included in the result set (e.g. description, homepage, engines).
157157

158158
### Configuration

‎docs/lib/content/commands/npm-sbom.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ SBOMs can be generated in either [SPDX](https://spdx.dev/) or [CycloneDX](https:
205205

206206
### Package lock only mode
207207

208-
If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded.
208+
If package-lock-only is enabled, only the information in the package lock is loaded.
209209
This means that information from the package.json files of your dependencies will not be included in the result set (e.g.
210210
description, homepage, engines).
211211

‎docs/lib/content/commands/npm-shrinkwrap.md‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎docs/lib/content/commands/npm-uninstall.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ This uninstalls a package, completely removing everything npm installed on its b
1515
It also removes the package from the `dependencies`, `devDependencies`,
1616
`optionalDependencies`, and `peerDependencies` objects in your `package.json`.
1717

18-
Further, if you have an `npm-shrinkwrap.json` or `package-lock.json`, npm will update those files as well.
18+
Further, if you have a `package-lock.json`, npm will update that file as well.
1919

20-
`--no-save` will tell npm not to remove the package from your `package.json`, `npm-shrinkwrap.json`, or `package-lock.json` files.
20+
`--no-save` will tell npm not to remove the package from your `package.json` or `package-lock.json` files.
2121

22-
`--save` or `-S` will tell npm to remove the package from your `package.json`, `npm-shrinkwrap.json`, and `package-lock.json` files.
22+
`--save` or `-S` will tell npm to remove the package from your `package.json` and `package-lock.json` files.
2323
This is the default, but you may need to use this if you have for instance `save=false` in your `npmrc` file
2424

2525
In global mode (ie, with `-g` or `--global` appended to the command), it uninstalls the current package context as a global package.
@@ -33,14 +33,14 @@ Scope is optional and follows the usual rules for [`scope`](/using-npm/scope).
3333
npm uninstall sax
3434
```
3535

36-
`sax` will no longer be in your `package.json`, `npm-shrinkwrap.json`, or `package-lock.json` files.
36+
`sax` will no longer be in your `package.json` or `package-lock.json` files.
3737

3838
```bash
3939
npm uninstall lodash --no-save
4040
```
4141

42-
`lodash` will not be removed from your `package.json`,
43-
`npm-shrinkwrap.json`, or `package-lock.json` files.
42+
`lodash` will not be removed from your `package.json` or
43+
`package-lock.json` files.
4444

4545
### Configuration
4646

‎docs/lib/content/commands/npm-update.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,6 @@ NOTE: If a package has been upgraded to a version newer than `latest`, it will b
141141

142142
* [npm install](/commands/npm-install)
143143
* [npm outdated](/commands/npm-outdated)
144-
* [npm shrinkwrap](/commands/npm-shrinkwrap)
145144
* [npm registry](/using-npm/registry)
146145
* [npm folders](/configuring-npm/folders)
147146
* [npm ls](/commands/npm-ls)

‎docs/lib/content/commands/npm-version.md‎

Lines changed: 1 addition & 2 deletions

0 commit comments

Comments
 (0)