--dev not checking for consistency in node_modules

[vvo]

package.json:

{
  "name": "shrinkwrap-test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "Algolia <[email protected]> (https://github.com/algolia/)",
  "license": "MIT",
  "dependencies": {
    "async": "^1.5.0"
  },
  "devDependencies": {
    "lodash": "^3.10.1"
  }
}

node_modules:

> tree node_modules 
node_modules
└── async
    ├── CHANGELOG.md
    ├── dist
    │   ├── async.js
    │   └── async.min.js
    ├── lib
    │   └── async.js
    ├── LICENSE
    ├── package.json
    └── README.md

Running npm-shrinkwrap --dev is a success:

> npm-shrinkwrap --dev
wrote npm-shrinkwrap.json

I really do not know if that's expected behavior, I would say no.

I am using the npm-shrinkwrap as part of our build but also CI test, so that we can ensure an added package in package.json was also added to shrinkwrap.

What do you think?

[vvo]

What's even weirder is that running npm install WILL install lodash (declared as devDependency), maybe that's more of an npm issue. Do you have insights?

[Raynos]

Is this npm-shrinkwrap@5 or npm-shrinkwrap@200 ?

[vvo]

This is npm-shrinkwrap@5, node v4, npm@2

[vvo]

Just tried with npm-shrinkwrap@200 (seems like we should use this one since we use npm2), same result

[vvo]

Any new on this one?