alistairjcbrown / check-dependency-lists Goto Github PK

Validate more than the root dependencies of the shrinkwrap - provide a flag to do a deep comparison between the installed dependencies and shrinkwrap.
This will be handy for making sure a dependency cache is up to date.

npm can be pulled in a a module through require (peerDependency?) - could the ls --depth=0 --json pieces of this be converted into a call to the npm module, rather than through command line?

This lib uses semver to confirm version matches package.json - but will this work for repo urls or non-semver versions?

npm is up to version 3, but this has a dependency version of 2. What happens when this is used in conjunction with node 5.1.0 which has npm v3 with it?

For those times when dev dependencies are not part of the shrinkwrap (no --dev flag), provide the ability to only check non-dev dependencies.

npm v3 flattens the node_modules directory and pulls modules to the root level in order to dedupe.
These are picked up in the shrinkwrap. Now we have "installed" modules at the root level of node_modules, and root level modules in the shrinkwrap, which aren't in the package.json file. This will cause this to error out, even though it's valid.