blog.nodejs.org
Managing Node.js Dependencies with Shrinkwrap
When you "npm install" a package with dependencies, there’s no guarantee that you’ll get the same set of code now that you would have gotten an hour ago, or that you would get if you were to run it again an hour later. You may get a bunch of bug fixes now that weren’t available an hour ago. This is great during development, where you want to keep up with changes upstream. It’s not necessarily what you want for deployment, though, where you want to validate whatever bits you’re actually shipping.