Add npm-shrinkwrap.json on every release

Core Development Feature Requests
1

Add npm-shrinkwrap.json on every release. This will ensure nobody gets hacked because of updates from transient dependencies during global installs as it will lock all dependencies like a package-lock would, but for consumers.

Node-RED releases don't have a node-shrinkwrap.json yet.

IMG-20250916-WA0000
IMG-20250916-WA00001285Ă—1600 79.4 KB

3

Apparently only occurs for local file/folder installs so should still be good for normal installs:

image
image873Ă—613 47.3 KB

1 Like
4

Good catch

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.