feat!: stop including npm-shrinkwrap.json

[serhalp]

Summary

Per https://docs.npmjs.com/cli/v11/configuring-npm/npm-shrinkwrap-json, one of the intended use cases for npm-shrinkwrap.json is

command-line tools intended as global installs or devDependencies

For several years, this is what we've done with Netlify CLI.

This has come with... some pushback: #6731. Including from the creator of NPM.

On one hand, ensuring dependencies are pinned makes installs deterministic and helps with security by preventing certain classes of supply chain vulnerabilities.

On the other hand, when vulnerabilities are disclosed and patched, Netlify CLI users cannot benefit from those patches until Netlify CLI maintainers specifically bump them and publish a new release. Users can't even npm audit fix.

Also, pnpm, yarn, bun, and all package managers other than npm do not respect npm-shrinkwrap.json anyway.

It also honestly adds some maintenance complexity for us. We have some strange scripts needed to make this work, for example to exclude our own dev dependencies from the file. We've encountered some strange shrinkwrap-specific bugs. And reacting quickly to all the incoming CVEs is disruptive.

Also, in some cases users may lose out on potential dependency deduping in their tree (and global caching on their machine, with some package managers).

✅ Verdict: remove it.

Closes #6731

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3ba694bf-ef5e-484f-be7a-2883a7328496

📥 Commits

Reviewing files that changed from the base of the PR and between 4b0b29e and 716f488.

📒 Files selected for processing (1)

• package.json

💤 Files with no reviewable changes (1)

• package.json

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Removed the automatic pre-publish lifecycle hook and related publishing script.
  • Excluded shrinkwrap file from the distributed package.
  • Simplified packaging flow by removing shrinkwrap validation and regeneration steps.
  • Cleaned up and reduced packaging-related scripts and unused build utilities.

Walkthrough

Removed npm-shrinkwrap.json from the published files in package.json and removed the prepublishOnly npm script entry. Deleted scripts/prepublishOnly.js. Updated scripts/netlifyPackage.js to drop shrinkwrap validation/regeneration and removed some unused imports and logic that previously altered package.json scripts.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: stopping the inclusion of npm-shrinkwrap.json in the distributed package.
Description check	✅ Passed	The description is directly related to the changeset, providing clear rationale for removing npm-shrinkwrap.json and its associated infrastructure.
Linked Issues check	✅ Passed	The PR successfully addresses issue #6731 by removing the npm-shrinkwrap.json file and related scripts, allowing users to receive security updates and use npm audit fix.
Out of Scope Changes check	✅ Passed	All changes are directly related to removing npm-shrinkwrap.json infrastructure: removed the file from package.json, deleted the prepublishOnly script, and simplified netlifyPackage.js accordingly.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch serhalp/rm-shrinkwrap

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📊 Benchmark results

Comparing with 28c958f

• Dependency count: 1,061 (no change)
• Package size: 355 MB (no change)
• Number of ts-expect-error directives: 356 (no change)