The document discusses the problem of dependencies changing between development and production when using npm. It notes that unless exact versions are specified, dependencies can update and break reproducibility. The proposed solution is to use npm shrinkwrap, which locks down the entire dependency tree to currently installed versions. This prevents dependencies from changing unintentionally later on.

1. Kevin Ball @kbal11
NPM Shrinkwrap
Do Your Future Self a Favor
Kevin Ball
http://kevinball.com
http://twitter.com/kbal11

2. Kevin Ball @kbal11
The Problem
//package.json
{
“dependencies”: {
“express”: “~3”,
“rendr” : “~0.5”
}
}

3. Kevin Ball @kbal11
The Problem
> npm install
rendr@0.5.2 node_modules/rendr
…
express@3.20.2 node_modules/express

4. Kevin Ball @kbal11
The Problem
> npm install
rendr@0.5.2 node_modules/rendr
…
express@3.20.2 node_modules/express
Three months later, in production…

5. Kevin Ball @kbal11
The Problem
> npm install
rendr@0.5.2 node_modules/rendr
…
express@3.21.5 node_modules/express
Three months later, in production…

6. Kevin Ball @kbal11
The Problem
Three months later, in production…
Image: CC courtesy of nirufe on Flikr

7. Kevin Ball @kbal11
The Problem
//package.json
{
“dependencies”: {
“express”: “~3”,
“rendr” : “~0.5”
}
}

8. Kevin Ball @kbal11
The Problem
//package.json
{
“dependencies”: {
“express”: “3.20.2”,
“rendr” : “~0.5”
}
}

9. Kevin Ball @kbal11
The Problem
//package.json
{
“dependencies”: {
“express”: “3.20.2”,
“rendr” : “0.5.2”
}
}

10. Kevin Ball @kbal11
The Problem
And still…
Image: CC courtesy of nirufe on Flikr

11. Kevin Ball @kbal11
The Problem
Unless every NPM package uses exact
package versions, you don’t have
reproducible builds!

12. Kevin Ball @kbal11
The Solution
NPM Shrinkwrap locks down your entire
tree of dependencies to the current
installed versions.

13. Kevin Ball @kbal11
The Solution
> npm shrinkwrap
> git add npm-shrinkwrap.json
> git commit -m “Saving myself from strife
down the road”

14. Kevin Ball @kbal11
Questions?

15. Kevin Ball @kbal11
NPM Shrinkwrap
Do Your Future Self a Favor
Kevin Ball
http://kevinball.com
http://twitter.com/kbal11