Skip to content

chore!: remove npm shrinkwrap, bundle package dependencies - #1135

Open
Renegade334 wants to merge 1 commit into
nodejs:mainfrom
Renegade334:bundle-dependencies
Open

chore!: remove npm shrinkwrap, bundle package dependencies#1135
Renegade334 wants to merge 1 commit into
nodejs:mainfrom
Renegade334:bundle-dependencies

Conversation

@Renegade334

@Renegade334 Renegade334 commented Aug 3, 2026

Copy link
Copy Markdown
Member

Alternative to #1121.

"Locks" the full dependency tree for consumers by bundling the dependencies (as constrained by our own package-lock.json) with the published package.

The size of the @node-core/utils package goes from

npm notice Tarball Details
npm notice package size: 206.1 kB
npm notice unpacked size: 839.8 kB
npm notice total files: 108

to

npm notice Tarball Details
npm notice package size: 8.0 MB
npm notice unpacked size: 39.7 MB
npm notice bundled deps: 355
npm notice bundled files: 0
npm notice own files: 7076
npm notice total files: 7076

although the dependencies that are now bundled would previously have to be resolved and installed by npm anyway.

The main differences from shrinkwrap:

  • npm extracts the bundled node_modules tree verbatim into node-core-utils/node_modules, as opposed to performing npm dependency resolution with fixed versions from npm_shrinkwrap. This means that it's no longer possible for npm to perform any deduplication at parent levels, so in the theoretical worst-case scenario where node-core-utils is installed globally alongside a load of other packages that have near-identical dependencies, this could add a maximum of ~40MB in no-longer-deduplicated node_modules overhead (although in reality this should never be a significant issue).
  • In what appears to be an npm bug, npm pack goes into an infinite resolution loop if a bundled dependency is overridden by an overrides entry, which we were relying upon until recently (984125a). I'll report upstream, but for the time being, we wouldn't be able to call upon this feature if needed.

npm-shrinkwrap.json previously ensured that a consumer installing the
NCU package would also install the exact dependency versions from
npm-shrinkwrap.json. This npm feature is being withdrawn.

To avoid exposing NCU consumers to supply chain issues in transitive
dependencies, we now bundle a copy of our "locked" dependency tree
in the package that is published to npm.
@codecov

codecov Bot commented Aug 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.32%. Comparing base (4d967bf) to head (578738c).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1135   +/-   ##
=======================================
  Coverage   57.32%   57.32%           
=======================================
  Files          53       53           
  Lines       10368    10368           
=======================================
  Hits         5943     5943           
  Misses       4425     4425           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Renegade334 Renegade334 linked an issue Aug 3, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

npm shrink wrap is deprecated

1 participant