npm-shrinkwrap.json file is useless and makes troubles with npm 7 (and npm 8)

[crutch12]

1. shrinkwrap adds 12k code line to my lock file after install with npm 8
2. npm 8 has a bug and it installs even dev: true deps. So with npm ci you get error Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin"} (current: {"os":"linux","arch":"x64"})

I think we should remove npm-shrinkwrap.json file at all

UPD: I've tried to install branch-name-lint without npm-shrinkwrap.json and it works well. So it looks like that npm-shrinkwrap.json is used only for security issues #9

[crutch12]

temporarily published own package without npm-shinkwrap.json file: https://www.npmjs.com/package/@web-bee-ru/branch-name-lint

[yoavain-sundaysky]

I don't think the idea of having an npm-shrinkwrap.json file is wrong.
When you publish a package whose purpose is to run as a tool, you want to make sure that all runtime dependencies (and their dependencies) are those you tested with. You cannot control transitive dependencies without this npm-shrinkwrap.json.
The problem is this file contains both runtime and dev dependencies.

I had to deal with a similar issue in my project, and the solution was this:

• Commit the package-lock.json file and not the npm-shrinkwrap.json
• In your pipeline, after you run tests and build the project and before you pack your package, run a script that:
  1. Removes dev dependencies
  2. Deletes package-lock.json file*
  3. Creates npm-shrinkwrap.json file

Something like this:

npm prune --production && del package-lock.json && npm shrinkwrap

* The reason to delete the package-lock.json file is that npm prune --production only deletes files from the node_modules folder and does not update the package-lock.json file, and the npm shrinkwrap only rename the package-lock.json to npm-shrinkwrap.json if it exists. When package-lock.json does not exist, the npm-shrinkwrap.json file is created from the existing dependencies tree (which represent the committed package-lock.json file, without the dev dependencies)

[yoavain]

@barzik
I can open a PR with the above change, but let me know if the solution is accepted