Issues due to shrinkwrap.json about dynamodb-oop HOT 3 CLOSED

Indeed thats what the documentation says !

Few versions ago, one of @awspilot/dynamodb dev dependencies
had vulnerable deps ( that pushed me on page 13 in search results )
and the only way to control the dependency tree was
to use npm-shrinkwrap to lock down the vuln package to specific version.

This is when the file was added, I see it as a way of protecting
the library users from installing vulnerable dependencies
( which I believe is my responsibility ).

On the other hand npms.io ( behind npmjs.com search )
will rank you lower if you don't have one .

https://nodejs.org/en/blog/npm/managing-node-js-dependencies-with-shrinkwrap/
says: Run "npm shrinkwrap", commit the new npm-shrinkwrap.json, and publish your package.

Please let me know if you have any other references saying including it is bad.
I could just add npm-shrinkwrap to .npmignore but I wont do that now.

from dynamodb-oop.

another post http://npm.github.io/using-pkgs-docs/shrinkwrap/index.html
also says Commit the new npm-shrinkwrap.json, and publish your package.

from dynamodb-oop.

I'm closing the issue for now as I can;t find evidence
that including it in the package is bad practice

from dynamodb-oop.