# Add npm-shrinkwrap.json on every release

**URL:** <https://discourse.nodered.org/t/add-npm-shrinkwrap-json-on-every-release/99068>\
**Category:** Feature Requests\
**Created:** [16 September 2025 13:01 UTC](https://discourse.nodered.org/t/add-npm-shrinkwrap-json-on-every-release/99068 "2025-09-16T13:01:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [16 September 2025 13:01 UTC](https://discourse.nodered.org/t/add-npm-shrinkwrap-json-on-every-release/99068/1 "2025-09-16T13:01:48Z")

</div>

Add npm-shrinkwrap.json on every release. This will ensure nobody gets hacked because of updates from transient dependencies during global installs as it will lock all dependencies like a package-lock would, but for consumers.

> **[npm-shrinkwrap.json | npm Docs](https://docs.npmjs.com/cli/v8/configuring-npm/npm-shrinkwrap-json/)**
>
> A publishable lockfile

Node-RED releases don't have a node-shrinkwrap.json yet.

 ![IMG-20250916-WA0000](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/e/9/e964cc9dc55135e500ba4b4f4930251608f48da9.jpeg)

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [16 September 2025 15:23 UTC](https://discourse.nodered.org/t/add-npm-shrinkwrap-json-on-every-release/99068/3 "2025-09-16T15:23:56Z")

</div>

Apparently only occurs for local file/folder installs so should still be good for normal installs:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/1/f/1f5449222b0875913e57b44a357fbec257501d87.png)

---

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [16 September 2025 17:21 UTC](https://discourse.nodered.org/t/add-npm-shrinkwrap-json-on-every-release/99068/4 "2025-09-16T17:21:29Z")

</div>

Good catch

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [15 November 2025 17:22 UTC](https://discourse.nodered.org/t/add-npm-shrinkwrap-json-on-every-release/99068/5 "2025-11-15T17:22:20Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.