Lock-down dependencies with npm shrinkwrap

[shesek]

The npm shrinkwrap feature allows locking-down the package dependencies even when installed as an npm package and not manually from source. It is generally recommended to enable this for top-level apps like daemons and CLI tools, but not for libraries intended to be used as part of a larger app.

Other than ensuring a consistent environment and preventing dependency issues, locking down to specific versions also has the security advantage of package updates having to be explicit. To give a recent example, automatic updates of packages down the dependency tree helped enable the Copay hack just a few months ago. With npm shrinkwrap, the malicious version of the event-stream dependency wouldn't be installed unless the copay developers explicitly updated their deps inside the time window where event-stream was vulnerable -- which is still possible, but much less likely.

To enable shrinkwrap, just run npm shrinkwrap, which will rename the package-lock.json file to npm-shrinkwrap.json, and check that in.

There's some more information on shrinkwrap on the npm blog (from the web archive, appears to be unavailable on the website for some reason).

[shesek]

Thank you Dan!

[shesek]

With this in and with the new configuration management and CLI executable, perhaps its a good time to consider publishing btc-rpc-explorer to the NPM registry?

[janoside]

You're welcome! And yes, I'm on board for publishing. Haven't done it before but it looks super simple - just signed up with npmjs.com and logged in via cli. Now it's just npm publish, right? Is there anything else I should think about differently after it's done - for example be more conscious about updating the version in package.json and republishing after major changes?

[shesek]

Yes, super simple indeed, just npm publish and it'll go live :)

Other than that, yes, you should think about bumping the version and issuing a new release when you feel things are stable. NPM makes that pretty easy, running npm version patch will bump the patch version (the z in x.y.z) in the package.json, commit the changes and make a new git tag. You can also use minor and major to bump the y/x parts. After that, you'll probably also want to push the new tag to github with git push --tags, which will make it appear on the "Releases" tab.

[janoside]

Ah very cool. Thanks for the info, as always :)

https://www.npmjs.com/package/btc-rpc-explorer

[shesek]

Awesome! I'll send a PR to update the installation instructions :)