npm-projects.md

Show me the code! Do you prefer seeing how something works instead of instructions? If so, check out this pull request to the Amortize module. Each instruction below lives as its own commit. cfpb/amortize#11

1. Add an .npmrc file.

The contents of the file should be:

save-exact=true

This will ensure that all new dependencies are installed at the exact version number, ensuring that incremental version changes are intentional.

2. Pin existing dependencies

Pin all project dependencies in the package.json. npm's defualt behavior is to download incremental updates to packages. By removing ~ or ^ from a dependency's version number in the package.json we are able to ensure that we're always using the same version of the package.

Example of pinned dendencies:

"dependencies": {
    "backbone": "1.0.0",
    "jquery": "1.11.3",
    "underscore": "1.4.4"
}
 

3. Run npm shrinkwrap

Run npm shrinkwrap in the root of your project. This will not only pin your direct dependencies but do the same for their dependencies. This ensures that the project uses the same dependency versions in all environments. Running this command will produce an npm-shrinkwrap.json file.

4. Set up Snyk

First, install snyk globally on your machine and then run Snyk's wizard from the root of your project's directory:

npm install –g snyk
snyk wizard

Snyk will walk you through updating vulnerable dependencies and ask if you want to add snyk test to your package.json, reply yes. In npm test isn't run automatically as part of your project build step, be sure to add it so that the snyk test is run as part of the Travis and Jenkins build process.

Note: For a project with some out of date dependencies, I had to run this a couple of times to get everything passing.

I would recommend adding .snyk to your .gitignore as I don't think that there's a need for it being checked into source control.