tl;dr natives
/ graceful-fs@3.x
/ vinyl-fs >= 0.2.1, < 2.0.0
/ gulp@^3.7.0
/ fs-readfile-promise >= 1.1.0, < 2.0.1
/ gulp-wrap >= 0.10.0, < 0.12.0
doesn't work on nodejs >= 12
.
natives
doesn't work on nodejs >= 12
. Before 1.1.3
you get:
node[21]: ../src/node_contextify.cc:649:static void node::contextify::ContextifyScript::New(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `args[1]->IsString()' failed.
ReferenceError: primordials is not defined
I can't check the core dump right now but my guess would be that you have code somewhere, possibly in a dependency, that uses
process.binding('contextify')
directly.
yes we changed the internal
contextify
script to be less lenient with what it accepts. you'll have to update any modules that use it, or better yet find alternatives that don't depend onnode
internals.
$ npm view natives versions
'1.0.0', ..., '1.1.2', '1.1.3', ..., '1.1.6'
$ check() { docker run --rm "$1" sh -xc 'npm i '"$2"' && echo "var natives = require(\"natives\"); natives.require(\"fs\");" | node'; }
$ check node:11.15.0-alpine natives@1.1.6
...
+ node
$ check node:12-alpine3.11 natives@1.0.0
...
+ node
node[21]: ../src/node_contextify.cc:649:static void node::contextify::ContextifyScript::New(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `args[1]->IsString()' failed.
Aborted (core dumped)
$ check node:12-alpine3.11 natives@1.1.2
...
+ node
node[21]: ../src/node_contextify.cc:649:static void node::contextify::ContextifyScript::New(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `args[1]->IsString()' failed.
Aborted (core dumped)
$ check node:12-alpine3.11 natives@1.1.3
....
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:137:5)
at Object.req [as require] (/node_modules/natives/index.js:54:10)
at [stdin]:1:43
at Script.runInThisContext (vm.js:120:20)
at Object.runInThisContext (vm.js:311:38)
at Object.<anonymous> ([stdin]-wrapper:10:26)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at evalScript (internal/process/execution.js:94:25)
at internal/main/eval_stdin.js:29:5
$ check node:12-alpine3.11 natives@1.1.6
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at [stdin]:1:43
at Script.runInThisContext (vm.js:120:20)
at Object.runInThisContext (vm.js:311:38)
at Object.<anonymous> ([stdin]-wrapper:10:26)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at evalScript (internal/process/execution.js:94:25)
at internal/main/eval_stdin.js:29:5
In 3.0.0
(2.1.0
to be precise, but this version was never published)
graceful-fs
started using the internal natives
module.
In 3.0.10
they decided to not reinvent the wheel,
and added the natives
package dependency.
In 4.0.0
a better solution was found.
$ npm view graceful-fs versions
'2.0.3', '3.0.0', ..., '3.0.9', '3.0.10', ..., '3.0.12', '4.1.0', ...
$ npm view graceful-fs@3.0.9 dependencies | grep natives
$ npm view graceful-fs@3.0.10 dependencies | grep natives
natives: '^1.0.1',
$ npm view graceful-fs@3.0.12 dependencies | grep natives
natives: '^1.1.3',
$ npm view graceful-fs@4.1.0 dependencies | grep natives
$ check() { docker run --rm "$1" sh -xc 'npm i '"$2"' && echo "var fs = require(\"graceful-fs\");" | node'; }
$ check node:12-alpine3.11 graceful-fs@2.0.3
...
+ node
$ check node:12-alpine3.11 graceful-fs@3.0.0
...
+ node
undefined:35
} = primordials;
^
ReferenceError: primordials is not defined
at eval (eval at <anonymous> (/node_modules/graceful-fs/fs.js:5:1), <anonymous>:35:5)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:5:1)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
at Object.<anonymous> (/node_modules/graceful-fs/graceful-fs.js:3:27)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
$ check node:12-alpine3.11 graceful-fs@3.0.12
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 graceful-fs@4.1.0
...
+ node
vinyl-fs
was using graceful-fs@3.x
since 0.2.1
to 1.0.0
inclusive (vinyl-fs >= 0.2.1, < 2.0.0
).
$ npm view vinyl-fs versions
..., '0.2.0', '0.2.1', ..., '1.0.0', '2.0.0', ...
$ npm view vinyl-fs@0.2.0 dependencies | grep graceful
'graceful-fs': '^2.0.1',
$ npm view vinyl-fs@0.2.1 dependencies | grep graceful
'graceful-fs': '^3.0.0',
$ npm view vinyl-fs@1.0.0 dependencies | grep graceful
'graceful-fs': '^3.0.0',
$ npm view vinyl-fs@2.0.0 dependencies | grep graceful
'graceful-fs': '^4.0.0',
check() { docker run --rm "$1" sh -xc 'npm i '"$2"' && echo "var fs = require(\"vinyl-fs\");" | node'; }
$ check node:12-alpine3.11 vinyl-fs@0.2.0
...
+ node
$ check node:12-alpine3.11 vinyl-fs@0.2.1
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 vinyl-fs@1.0.0
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 vinyl-fs@2.0.0
...
+ node
gulp
was using the faulty vinyl-fs
versions
since 3.7.0
till 3.9.1
inclusive (gulp >= 3.7.0, < 4.0.0
).
$ npm view gulp versions
..., '3.6.2', '3.7.0', ..., '3.9.1', '4.0.0', ...
$ npm view gulp@3.6.2 dependencies | grep vinyl
'vinyl-fs': '^0.1.3',
$ npm view gulp@3.7.0 dependencies | grep vinyl
'vinyl-fs': '^0.2.0',
$ npm view gulp@3.9.1 dependencies | grep vinyl
'vinyl-fs': '^0.3.0',
$ npm view gulp@4.0.0 dependencies | grep vinyl
'vinyl-fs': '^3.0.0',
$ check() { docker run --rm "$1" sh -xc 'npm i '"$2"' && echo "var gulp = require(\"gulp\");" | node'; }
$ check node:12-alpine3.11 gulp@3.6.2
...
+ node
$ check node:12-alpine3.11 gulp@3.7.0
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/vinyl-fs/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 gulp@3.9.1
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 gulp@4.0.0
...
+ node
fs-readfile-promise
was using graceful-fs@3.x
since 1.1.0
till 2.0.0
inclusive
(fs-readfile-promise >= 1.1.0, < 2.0.1
).
$ npm view fs-readfile-promise versions
..., '1.0.1', '1.1.0', ..., '2.0.0', '2.0.1', ...
$ npm view fs-readfile-promise@1.0.1 dependencies | grep graceful
$ npm view fs-readfile-promise@1.1.0 dependencies | grep graceful
'graceful-fs': '^3.0.5'
$ npm view fs-readfile-promise@2.0.0 dependencies | grep graceful
'graceful-fs': '^3.0.7'
$ npm view fs-readfile-promise@2.0.1 dependencies | grep graceful
'graceful-fs': '^4.1.2'
$ check() { docker run --rm "$1" sh -xc 'npm i '"$2"' && echo "var readFilePromise = require(\"fs-readfile-promise\");" | node'; }
$ check node:12-alpine3.11 fs-readfile-promise@1.0.1
...
+ node
$ check node:12-alpine3.11 fs-readfile-promise@1.1.0
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 fs-readfile-promise@2.0.0
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 fs-readfile-promise@2.0.1
...
+ node
gulp-wrap
was using the faulty fs-readfile-promise
versions
since 0.10.0
till 0.11.0
inclusive
(gulp-wrap >= 0.10.0, < 0.12.0
).
$ npm view gulp-wrap versions
'0.9.0', '0.10.0', ..., '0.11.0', '0.12.0', ...
$ npm view gulp-wrap@0.9.0 dependencies | grep 'fs-readfile-promise|graceful'
$ npm view gulp-wrap@0.10.0 dependencies | grep 'fs-readfile-promise|graceful'
'fs-readfile-promise': '^1.1.0',
$ npm view gulp-wrap@0.11.0 dependencies | grep 'fs-readfile-promise|graceful'
'fs-readfile-promise': '^1.1.0',
$ npm view gulp-wrap@0.12.0 dependencies | grep 'fs-readfile-promise|graceful'
'fs-readfile-promise': '^2.0.1',
$ check() { docker run --rm "$1" sh -xc 'npm i '"$2"' && echo "var wrap = require(\"gulp-wrap\");" | node'; }
$ check node:12-alpine3.11 gulp-wrap@0.9.0
...
+ node
$ check node:12-alpine3.11 gulp-wrap@0.10.0
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 gulp-wrap@0.11.0
...
+ node
fs.js:35
} = primordials;
^
ReferenceError: primordials is not defined
at fs.js:35:5
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:1156:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1176:10)
at Module.load (internal/modules/cjs/loader.js:1000:32)
at Function.Module._load (internal/modules/cjs/loader.js:899:14)
at Module.require (internal/modules/cjs/loader.js:1042:19)
at require (internal/modules/cjs/helpers.js:77:18)
$ check node:12-alpine3.11 gulp-wrap@0.12.0
...
+ node
- Add
npm-shrinkwrap.json
:
{"dependencies": {"graceful-fs": {"version": "4.2.3"}}}
npm install
1.sh
:
#!/bin/sh
set -eux
echo {} > package.json
npm install is-negative@2.0.1 gulp@3.x
echo '
{
"dependencies": {
"graceful-fs": {
"version": "4.2.3"
}
}
}
' > npm-shrinkwrap.json
npm ls graceful-fs || true
npm ls is-negative || true
grep '"version":' node_modules/is-negative/package.json
npm install
echo '
var gulp = require("gulp");
' | node
npm ls is-negative || true
grep '"version":' node_modules/is-negative/package.json || true
npm ls graceful-fs || true
npm install is-sorted
echo '
var gulp = require("gulp");
' | node || true
npm ls graceful-fs || true
$ docker run --rm -it -v "$PWD"/1.sh:/1.sh node:12-alpine3.11 ./1.sh
+ echo '{}'
Install is-negative
and gulp
:
+ npm install is-negative@2.0.1 gulp@3.x
npm WARN deprecated gulp-util@3.0.8: gulp-util is deprecated - replace it, following the guidelines a
t https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp Do
S issue
npm WARN deprecated minimatch@0.2.14: Please update to minimatch 3.0.2 or higher to avoid a RegExp Do
S issue
npm WARN deprecated graceful-fs@1.2.3: please upgrade to graceful-fs 4 for compatibility with current
and future versions of Node.js
npm WARN deprecated natives@1.1.6: This module relies on Node.js's internals and will break at some p
oint. Do not use it, and update to graceful-fs@4.x.
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN !invalid#1 No description
npm WARN !invalid#1 No repository field.
npm WARN !invalid#1 No license field.
+ is-negative@2.0.1
+ gulp@3.9.1
added 253 packages from 164 contributors and audited 1129 packages in 6.788s
1 package is looking for funding
run `npm fund` for details
found 7 vulnerabilities (1 low, 6 high)
run `npm audit fix` to fix them, or `npm audit` for details
Add npm-shrinkwrap.json
:
+ echo '
{
"dependencies": {
"graceful-fs": {
"version": "4.2.3"
}
}
}
'
graceful-js
is considered extraneous:
+ npm ls graceful-fs
npm WARN read-shrinkwrap Ignoring package-lock.json because there is already an npm-shrinkwrap.json.
Please use only one of the two.
npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@1, but npm-shrinkwrap
.json was generated for lockfileVersion@0. I'll try to do my best with it!
/
`-- graceful-fs@4.2.3 extraneous
npm ERR! extraneous: graceful-fs@4.2.3 /node_modules/graceful-fs
+ true
is-negative
unmet, but still installed:
+ npm ls is-negative
npm WARN read-shrinkwrap Ignoring package-lock.json because there is already an npm-shrinkwrap.json.
Please use only one of the two.
npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@1, but npm-shrinkwrap
.json was generated for lockfileVersion@0. I'll try to do my best with it!
/
`-- UNMET DEPENDENCY is-negative@^2.0.1
npm ERR! missing: is-negative@^2.0.1, required by !invalid#2
+ true
+ grep '"version":' node_modules/is-negative/package.json
"version": "2.0.1"
Install packages:
+ npm install
npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@1, but npm-shrinkwrap
.json was generated for lockfileVersion@0. I'll try to do my best with it!
npm WARN deprecated gulp-util@3.0.8: gulp-util is deprecated - replace it, following the guidelines a
t https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp Do
S issue
npm WARN deprecated minimatch@0.2.14: Please update to minimatch 3.0.2 or higher to avoid a RegExp Do
S issue
npm WARN !invalid#2 No description
npm WARN !invalid#2 No repository field.
npm WARN !invalid#2 No license field.
removed 2 packages, updated 2 packages and audited 1128 packages in 1.936s
found 7 vulnerabilities (1 low, 6 high)
run `npm audit fix` to fix them, or `npm audit` for details
gulp
works:
+ echo '
var gulp = require("gulp");
'
+ node
Judging from the output, it's not a proper state, but still graceful-fs@4.2.3
is installed:
+ npm ls graceful-fs
npm WARN read-shrinkwrap Ignoring package-lock.json because there is already an npm-shrinkwrap.json.
Please use only one of the two.
/
+-- graceful-fs@4.2.3 extraneous
`-- gulp@3.9.1
`-- vinyl-fs@0.3.14
+-- glob-watcher@0.0.6
| `-- gaze@0.5.2
| `-- globule@0.1.0
| `-- glob@3.1.21
| `-- UNMET DEPENDENCY graceful-fs@~1.2.0
`-- UNMET DEPENDENCY graceful-fs@^3.0.0
npm ERR! extraneous: graceful-fs@4.2.3 /node_modules/graceful-fs
npm ERR! missing: graceful-fs@^3.0.0, required by vinyl-fs@0.3.14
npm ERR! missing: graceful-fs@~1.2.0, required by glob@3.1.21
+ true
is-negative
was updated since package-lock.json
was ignored:
+ npm ls is-negative
npm WARN read-shrinkwrap Ignoring package-lock.json because there is already an npm-shrinkwrap.json.
Please use only one of the two.
/
`-- is-negative@2.1.0
+ grep '"version":' node_modules/is-negative/package.json
"version": "2.1.0"
Install a package:
+ npm install is-sorted
npm WARN deprecated graceful-fs@1.2.3: please upgrade to graceful-fs 4 for compatibility with current
and future versions of Node.js
npm WARN deprecated natives@1.1.6: This module relies on Node.js's internals and will break at some p
oint. Do not use it, and update to graceful-fs@4.x.
npm WARN !invalid#1 No description
npm WARN !invalid#1 No repository field.
npm WARN !invalid#1 No license field.
+ is-sorted@1.0.5
added 4 packages from 2 contributors, removed 1 package and audited 1130 packages in 1.214s
1 package is looking for funding
run `npm fund` for details
found 7 vulnerabilities (1 low, 6 high)
run `npm audit fix` to fix them, or `npm audit` for details
gulp
doesn't work anymore:
+ + echonode
'
var gulp = require("gulp");
'
fs.js:27
const { Math, Object } = primordials;
^
ReferenceError: primordials is not defined
at fs.js:27:26
at req_ (/node_modules/natives/index.js:143:24)
at Object.req [as require] (/node_modules/natives/index.js:55:10)
at Object.<anonymous> (/node_modules/vinyl-fs/node_modules/graceful-fs/fs.js:1:37)
at Module._compile (internal/modules/cjs/loader.js:955:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:991:10)
at Module.load (internal/modules/cjs/loader.js:811:32)
at Function.Module._load (internal/modules/cjs/loader.js:723:14)
at Module.require (internal/modules/cjs/loader.js:848:19)
at require (internal/modules/cjs/helpers.js:74:18)
+ true
Since npm
switched back to grateful-fs@3.x
:
+ npm ls graceful-fs
npm WARN read-shrinkwrap Ignoring package-lock.json because there is already an npm-shrinkwrap.json.
Please use only one of the two.
/
`-- gulp@3.9.1
`-- vinyl-fs@0.3.14
+-- glob-watcher@0.0.6
| `-- gaze@0.5.2
| `-- globule@0.1.0
| `-- glob@3.1.21
| `-- graceful-fs@1.2.3
`-- graceful-fs@3.0.12
So, there are nuances:
npm
doesn't consider the resulting state correct and fixes it at the next opportunity, the opportunity arrives when it has to make changes (e.g. install a package)- you might want to specify fixed versions in
package.json
before runningnpm install
, otherwise the corresponding packages will be updated (sincenpm-shrinkwrap.json
takes priority) - there's probably no helping the nested dependencies
package-lock.json
can be deleted afterwards, sincenpm-shrinkwrap.json
takes priority