npm-shrinkwrap.json file is useless and makes troubles with npm 7 (and npm 8) about branch-name-lint HOT 3 OPEN

temporarily published own package without npm-shinkwrap.json file: https://www.npmjs.com/package/@web-bee-ru/branch-name-lint

from branch-name-lint.

I don't think the idea of having an npm-shrinkwrap.json file is wrong.
When you publish a package whose purpose is to run as a tool, you want to make sure that all runtime dependencies (and their dependencies) are those you tested with. You cannot control transitive dependencies without this npm-shrinkwrap.json.
The problem is this file contains both runtime and dev dependencies.

I had to deal with a similar issue in my project, and the solution was this:

• Commit the package-lock.json file and not the npm-shrinkwrap.json
• In your pipeline, after you run tests and build the project and before you pack your package, run a script that:
  1. Removes dev dependencies
  2. Deletes package-lock.json file*
  3. Creates npm-shrinkwrap.json file

Something like this:

npm prune --production && del package-lock.json && npm shrinkwrap

* The reason to delete the package-lock.json file is that npm prune --production only deletes files from the node_modules folder and does not update the package-lock.json file, and the npm shrinkwrap only rename the package-lock.json to npm-shrinkwrap.json if it exists. When package-lock.json does not exist, the npm-shrinkwrap.json file is created from the existing dependencies tree (which represent the committed package-lock.json file, without the dev dependencies)

from branch-name-lint.

@barzik
I can open a PR with the above change, but let me know if the solution is accepted

from branch-name-lint.