As of writing this, npm@3 is out but shrinkwrap as even more issues. Stay with npm@2 for now.
We use shrinkwrap, because https://gist.github.com/vvo/84a94cfc0f94c91ea6b6.
We shrinkwrap both dependencies
and devDependencies
, otherwise the build and testing is not
consistent over time.
To update a package, given all the shrinkwrap weird bugs, you have to: