npm-shrinkwrap.json handles metadata inconsistently

[smals-fl]

With the change to leveraging shrinkwrap in angular-cli 1.0.0-beta.6 (from registry.npmjs.org), our builds started failing because shrinkwrap is forcing our npm client to try and resolve formly's dependencies from https://registry.npmjs.org (based on the resolved field). This may seem ok on the surface, but it completely breaks users who leverage a private npm repo (e.g. we're using Artifactory as our NPM repo).

Digging around a bit, I found some interesting issues filed on npm related to this:
npm/npm#6444
npm/npm#3581

Based on the comments in these threads, it sounds like:
a) shrinkwrap isn't really bulletproof
b) is probably not appropriate for libraries (at least in its current form).

Versions. Please run ng --version. If there's nothing outputted, please
angular-cli: 1.0.0-beta.6
node: 6.2.1
os: win32 x64

[filipesilva]

@hansl can you have a look?

[patorjk]

I had the same problem as described above. I was able to get around it by adding in the "--no-shrinkwrap" flag (npm install angular-cli -g --no-shrinkwrap), but it was still a little confusing.

[smals-fl]

Thanks for the tip patorjk, install works for me too. (with the beta.6 and beta.8)

[choucry13]

Hi, work for me too (beta.8)

[hansl]

Hi guys, I wanna test removing all URLs from the shrinkwrap file before publishing, but this skipped the latest release (beta.9). The only goal of the shrinkwrap is to fix the versions of dependencies, so there's no need to force a URL. I'll see what I can do for beta 10.

[hansl]

Closing this as deprecated. This has been fixed in our previous builds where we released shrink-wraps.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}