Start using shrinkwrap

[kernelwhisperer]

💥 Proposal

I think we should consider using npm shrinkwrap.

Why

• We encountered quite a few issues with dependencies: bugs in new releases, semver issues (people love using 0.x for major updates 🙄 ), etc.

• We spend a lot of time debugging: figuring out how is npm deduping packages, why does it work on one machine and not another, etc.

• The only (?) downside of using shrinkwrap is that people will not install the latest dependencies, but I don't see that as a problem. I think is better to wait a few weeks and then get a tested release.

[sohkai]

From https://docs.npmjs.com/files/shrinkwrap.json:

The recommended use-case for npm-shrinkwrap.json is applications deployed through the publishing process on the registry: for example, daemons and command-line tools intended as global installs or devDependencies.

Sounds like exactly what we need 😄!

[0xGabi]

Closed by #483