title: Node.js shrinkwrapped package.json causes npm install to update new versions regardless
body: <p>I've got a <code>npm-shrinkwrap.json</code> and a <code>package.json</code> in a git branch called "deployment". </p>
  
  <p>On my servers, I fetch and merge this deployment branch from github. This ensures that my servers have the latest deployment version.</p>
  
  <p>Because the node_modules binaries etc. are not being shipped, I need to run <code>npm install</code> or <code>npm update</code> on the server side too, after the project repository has been pulled from the server.</p>
  
  <p>This is why I decided to use <code>npm shrinkwrap</code>. However, even when I have this <code>npm-shrinkwrap.json</code> in the main folder and run <code>npm install</code>, it still installs newer versions of submodules, even though the shrinkwrapped json file has locked these down. It seems like npm does not even look at the shrinkwrap file.</p>
  
  <p>Could anyone explain why this happens, and how to resolve this situation?</p>
  
  <p>This is part of <code>package.json</code>:</p>
  
  <pre><code>"dependencies" : {
      "eventemitter2" : "0.4.9",
      "after"         : "0.4.1",
      "express"       : "2.5.9"
  },
  "devDependencies" : {
      "mocha"     : "&gt;= 1.0.3 &lt; 2",
      "should"    : "&gt;= 0.6.3 &lt; 1",
      "request"   : "&gt;= 2.9.202 &lt; 3",
      "commander" : "&gt;= 0.6.0 &lt; 1"
  },
  </code></pre>
  
  <p>Whereas <code>npm-shrinkwrap.json</code> is:</p>
  
  <pre><code>{
    "name": "appname",
    "version": "0.0.1",
    "dependencies": {
      "eventemitter2": {
        "version": "0.4.9"
      },
      "after": {
        "version": "0.4.1"
      },
      "express": {
        "version": "2.5.9",
        "dependencies": {
          "connect": {
            "version": "1.8.7",
            "dependencies": {
              "formidable": {
                "version": "1.0.9"
              }
            }
          },
          "mime": {
            "version": "1.2.4"
          },
          "qs": {
            "version": "0.4.2"
          },
          "mkdirp": {
            "version": "0.3.0"
          }
        }
      },
      "commander": {
        "version": "0.6.0"
      },
      "should": {
        "version": "0.6.3"
      },
      "request": {
        "version": "2.9.202"
      }
    }
  }
  </code></pre>
  
  <p>Yet, when I ran <code>npm install</code> it updated <code>qs</code> from version 0.4.2 to version 0.5.0. Also, it updated <code>mime</code> to 1.2.5. Why did it do this?</p>
  
  <p>The <code>npm install</code> returned this:</p>
  
  <pre><code>qs@0.5.0 ./node_modules/express/node_modules/connect/node_modules/qs
  mime@1.2.5 ./node_modules/express/node_modules/connect/node_modules/mime
  </code></pre>
  
  <p>Interestingly enough the shrinkwrap contains neither of these. I guess this is the problem. Now the question is why it did not contain these.</p>