We're aiming for deterministic package installs and using the tools the package manager,
npm, provides. Please install npm v3.x (not v1.x or 2.x). Upgrading a package (or adding a new one) should go as follows:
npm --version # should give you v3.10.10 or above (does not work with v1 or v2, and there's a bug in v3.10.8-9) npm i --no-optional email@example.com --save(-dev) npm shrinkwrap --dev # git review
Now everyone's happy and the patch got merged. Go to the deploy repo and:
git pull origin master git submodule update --init cd src/ git checkout sha-of-the-above-commit cd .. rm -rf node_modules/ npm i --no-optional git status # verify only what's expected got changed git review
Note that all the
--no-optional business here is because
service-runner > bunyan > dtrace-provider is an optional binary dependency that we want to avoid putting in the deploy repo.