{"action":"opened","issue":{"url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23","labels_url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23/comments","events_url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23/events","html_url":"https://github.com/gawel/gp.recipe.node/issues/23","id":82481413,"number":23,"title":"Is pinning of pulled in npm package dependenies possible?","user":{"login":"fredvd","id":394784,"avatar_url":"https://avatars.githubusercontent.com/u/394784?v=3","gravatar_id":"","url":"https://api.github.com/users/fredvd","html_url":"https://github.com/fredvd","followers_url":"https://api.github.com/users/fredvd/followers","following_url":"https://api.github.com/users/fredvd/following{/other_user}","gists_url":"https://api.github.com/users/fredvd/gists{/gist_id}","starred_url":"https://api.github.com/users/fredvd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fredvd/subscriptions","organizations_url":"https://api.github.com/users/fredvd/orgs","repos_url":"https://api.github.com/users/fredvd/repos","events_url":"https://api.github.com/users/fredvd/events{/privacy}","received_events_url":"https://api.github.com/users/fredvd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-29T15:51:16Z","updated_at":"2015-05-29T15:51:16Z","closed_at":null,"body":"The documentation mentions that you can pin node packages by specifying npmname@version in the recipe's npm = variable. \r\n\r\nbut what about packages that get pulled in by the packages listed in the recipe? For example with installing grutn you get the dependency tree below:\r\n\r\ngrunt@0.4.5 /Users/fred/buildouts/vmm-nieuw/parts/node/lib/node_modules/grunt\r\n+-- which@1.0.9\r\n+-- dateformat@1.0.2-1.2.3\r\n+-- eventemitter2@0.4.14\r\n+-- getobject@0.1.0\r\n+-- rimraf@2.2.8\r\n+-- colors@0.6.2\r\n+-- async@0.1.22\r\n+-- hooker@0.2.3\r\n+-- grunt-legacy-util@0.2.0\r\n+-- nopt@1.0.10 (abbrev@1.0.6)\r\n+-- exit@0.1.2\r\n+-- lodash@0.9.2\r\n+-- minimatch@0.2.14 (sigmund@1.0.1, lru-cache@2.6.4)\r\n+-- glob@3.1.21 (inherits@1.0.0, graceful-fs@1.2.3)\r\n+-- coffee-script@1.3.3\r\n+-- underscore.string@2.2.1\r\n+-- iconv-lite@0.2.11\r\n+-- js-yaml@2.0.5 (argparse@0.1.16, esprima@1.0.4)\r\n+-- grunt-legacy-log@0.1.2 (grunt-legacy-log-utils@0.1.1, underscore.string@2.3.3, lodash@2.4.2)\r\n`-- findup-sync@0.1.3 (glob@3.2.11, lodash@2.4.2)\r\n\r\nnpm supports the  'shrinkwrap' option to dump a full depth versionslist of all pulled in packages, but running this with gp.recipe.node's <buildout-dir>/bin/inpm shrinkwrap I get an empty npm-shrinkwrap.json. If and how are other users of this recipe doing this?"}}