Commit e84ea36
committed
chore!: remove npm shrinkwrap, bundle package dependencies
npm-shrinkwrap.json previously ensured that a consumer installing the
NCU package would also install the exact dependency versions from
npm-shrinkwrap.json. This npm feature is being withdrawn.
To avoid exposing NCU consumers to supply chain issues in transitive
dependencies, we now bundle a copy of our "locked" dependency tree
in the package that is published to npm.1 parent cb00ed8 commit e84ea36
2 files changed
Lines changed: 456 additions & 2 deletions
0 commit comments