{"action":"created","issue":{"url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23","labels_url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23/comments","events_url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23/events","html_url":"https://github.com/gawel/gp.recipe.node/issues/23","id":82481413,"number":23,"title":"Is pinning of pulled in npm package dependencies possible?","user":{"login":"fredvd","id":394784,"avatar_url":"https://avatars.githubusercontent.com/u/394784?v=3","gravatar_id":"","url":"https://api.github.com/users/fredvd","html_url":"https://github.com/fredvd","followers_url":"https://api.github.com/users/fredvd/followers","following_url":"https://api.github.com/users/fredvd/following{/other_user}","gists_url":"https://api.github.com/users/fredvd/gists{/gist_id}","starred_url":"https://api.github.com/users/fredvd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fredvd/subscriptions","organizations_url":"https://api.github.com/users/fredvd/orgs","repos_url":"https://api.github.com/users/fredvd/repos","events_url":"https://api.github.com/users/fredvd/events{/privacy}","received_events_url":"https://api.github.com/users/fredvd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-05-29T15:51:16Z","updated_at":"2015-06-22T16:03:20Z","closed_at":null,"body":"The documentation mentions that you can pin node packages by specifying npmname@version in the recipe's npm = variable. \r\n\r\nbut what about packages that get pulled in by the packages listed in the recipe? For example with installing grutn you get the dependency tree below:\r\n\r\ngrunt@0.4.5 /Users/fred/buildouts/vmm-nieuw/parts/node/lib/node_modules/grunt\r\n+-- which@1.0.9\r\n+-- dateformat@1.0.2-1.2.3\r\n+-- eventemitter2@0.4.14\r\n+-- getobject@0.1.0\r\n+-- rimraf@2.2.8\r\n+-- colors@0.6.2\r\n+-- async@0.1.22\r\n+-- hooker@0.2.3\r\n+-- grunt-legacy-util@0.2.0\r\n+-- nopt@1.0.10 (abbrev@1.0.6)\r\n+-- exit@0.1.2\r\n+-- lodash@0.9.2\r\n+-- minimatch@0.2.14 (sigmund@1.0.1, lru-cache@2.6.4)\r\n+-- glob@3.1.21 (inherits@1.0.0, graceful-fs@1.2.3)\r\n+-- coffee-script@1.3.3\r\n+-- underscore.string@2.2.1\r\n+-- iconv-lite@0.2.11\r\n+-- js-yaml@2.0.5 (argparse@0.1.16, esprima@1.0.4)\r\n+-- grunt-legacy-log@0.1.2 (grunt-legacy-log-utils@0.1.1, underscore.string@2.3.3, lodash@2.4.2)\r\n`-- findup-sync@0.1.3 (glob@3.2.11, lodash@2.4.2)\r\n\r\nnpm supports the  'shrinkwrap' option to dump a full depth versionslist of all pulled in packages, but running this with gp.recipe.node's <buildout-dir>/bin/inpm shrinkwrap I get an empty npm-shrinkwrap.json. If and how are other users of this recipe doing this?"},"comment":{"url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/comments/114165028","html_url":"https://github.com/gawel/gp.recipe.node/issues/23#issuecomment-114165028","issue_url":"https://api.github.com/repos/gawel/gp.recipe.node/issues/23","id":114165028,"user":{"login":"gawel","id":118673,"avatar_url":"https://avatars.githubusercontent.com/u/118673?v=3","gravatar_id":"","url":"https://api.github.com/users/gawel","html_url":"https://github.com/gawel","followers_url":"https://api.github.com/users/gawel/followers","following_url":"https://api.github.com/users/gawel/following{/other_user}","gists_url":"https://api.github.com/users/gawel/gists{/gist_id}","starred_url":"https://api.github.com/users/gawel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gawel/subscriptions","organizations_url":"https://api.github.com/users/gawel/orgs","repos_url":"https://api.github.com/users/gawel/repos","events_url":"https://api.github.com/users/gawel/events{/privacy}","received_events_url":"https://api.github.com/users/gawel/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T16:03:20Z","updated_at":"2015-06-22T16:03:20Z","body":"The problem exist because packages are installed with the -g option. I guess nobody use that in the js world. If you install packages by hand with npm install then shrinkwrap seems to work\r\n\r\nYou can also use:\r\n\r\n```\r\nHOME=$PWD/parts/node ./bin/npm -g shrinkwrap\r\n```\r\n\r\niif you have a package.json in parts/node ... If someone know why... let me know.\r\n\r\nNotice that recent versions of this recipe support package.json. You just need to add \".\" in the dependencie list. You have to list dependencies as dependencies. devDependencies will not work... Yet another weird effect.\r\n\r\nI'm usualy using something like this:\r\n\r\n```\r\n[node]\r\nrecipe = gp.recipe.node\r\nnpms =\r\n    gulp\r\n    bower\r\n    .\r\n```\r\n\r\nI'm adding gulp/bower so the recipe will create the binaries in bin/ for those packages."}}