feat!: drop npm-shrinkwrap.json support

BREAKING CHANGE: `npm shrinkwrap` is removed, the `shrinkwrap` config alias is removed, and `npm-shrinkwrap.json` is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root `npm-shrinkwrap.json` to `package-lock.json`; use `bundleDependencies` if you need to ship a locked dependency tree.

Author: Michael Smith

docs/lib/build.js

@@ -105,7 +105,6 @@ const generateNav = async (contentPath, navPath) => {
     '/configuring-npm/install',
     '/configuring-npm/folders',
     '/configuring-npm/npmrc',
-    '/configuring-npm/npm-shrinkwrap-json',
     '/configuring-npm/package-json',
     '/configuring-npm/package-lock-json',
   ]

docs/lib/content/commands/npm-shrinkwrap.md

@@ -14,8 +14,7 @@ description: Bump a package version
 
 ### Description
 
-Run this in a package directory to bump the version and write the new data back to `package.json`, `package-lock.json`, and, if present,
-`npm-shrinkwrap.json`.
+Run this in a package directory to bump the version and write the new data back to `package.json` and `package-lock.json`.
 
 The `newversion` argument should be a valid semver string, a valid second argument to [semver.inc](https://github.com/npm/node-semver#functions) (one of `patch`, `minor`, `major`, `prepatch`, `preminor`, `premajor`, `prerelease`), or `from-git`.
 In the second case, the existing version will be incremented by 1 in the specified field.

docs/lib/content/commands/npm-version.md

@@ -301,7 +301,7 @@ Some files are always ignored by default:
 * `config.gypi`
 * `node_modules`
 * `npm-debug.log`
-* `package-lock.json` (use [`npm-shrinkwrap.json`](/configuring-npm/npm-shrinkwrap-json) if you wish it to be published)
+* `package-lock.json`
 * `pnpm-lock.yaml`
 * `yarn.lock`
 * `bun.lockb`
@@ -872,7 +872,7 @@ These changes can be scoped as specific or as vague as desired.
 
 Overrides are only considered in the root `package.json` file for a project.
 Overrides in installed dependencies (including [workspaces](/using-npm/workspaces)) are not considered in dependency tree resolution.
-Published packages may dictate their resolutions by pinning dependencies or using an [`npm-shrinkwrap.json`](/configuring-npm/npm-shrinkwrap-json) file.
+Published packages may dictate their resolutions by pinning dependencies or using [`bundleDependencies`](#bundledependencies).
 
 To make sure the package `@npm/foo` is always installed as version `1.0.0` no matter what version your dependencies rely on:
 

docs/lib/content/configuring-npm/npm-shrinkwrap-json.md

@@ -23,16 +23,16 @@ This file is intended to be committed into source repositories, and serves vario
 
 When `npm` creates or updates `package-lock.json`, it will infer line endings and indentation from `package.json` so that the formatting of both files matches.
 
-### `package-lock.json` vs `npm-shrinkwrap.json`
+### `npm-shrinkwrap.json`
 
-Both of these files have the same format, and perform similar functions in the root of a project.
-
-The difference is that `package-lock.json` cannot be published, and it will be ignored if found in any place other than the root project.
-
-In contrast, [npm-shrinkwrap.json](/configuring-npm/npm-shrinkwrap-json) allows publication, and defines the dependency tree from the point encountered.
-This is not recommended unless deploying a CLI tool or otherwise using the publication process for producing production packages.
-
-If both `package-lock.json` and `npm-shrinkwrap.json` are present in the root of a project, `npm-shrinkwrap.json` will take precedence and `package-lock.json` will be ignored.
+As of npm v12, `npm-shrinkwrap.json` is no longer read or written by
+npm. Projects that previously committed `npm-shrinkwrap.json` should
+rename it to `package-lock.json`; the file format is identical. When
+npm v12 encounters a dependency that ships an `npm-shrinkwrap.json`
+inside its tarball, the file is ignored — publishers who need to ship
+a locked tree should use
+[`bundleDependencies`](/configuring-npm/package-json#bundledependencies)
+instead.
 
 ### Hidden Lockfiles
 
@@ -115,8 +115,6 @@ Package descriptors have the following fields:
 
 * hasInstallScript: A flag to indicate that the package has a `preinstall`, `install`, or `postinstall` script.
 
-* hasShrinkwrap: A flag to indicate that the package has an `npm-shrinkwrap.json` file.
-
 * bin, license, engines, dependencies, optionalDependencies: fields from `package.json`
 
 * os: An array of operating systems this package is compatible with, as specified in `package.json`. This field is included when the package specifies OS restrictions.
@@ -176,7 +174,5 @@ Dependency objects have the following fields:
 
 ### See also
 
-* [npm shrinkwrap](/commands/npm-shrinkwrap)
-* [npm-shrinkwrap.json](/configuring-npm/npm-shrinkwrap-json)
 * [package.json](/configuring-npm/package-json)
 * [npm install](/commands/npm-install)

docs/lib/content/configuring-npm/package-json.md

@@ -159,9 +159,6 @@
   - title: npm set
     url: /commands/npm-set
     description: Set a value in the npm configuration
-  - title: npm shrinkwrap
-    url: /commands/npm-shrinkwrap
-    description: Lock down dependency versions for publication
   - title: npm start
     url: /commands/npm-start
     description: Start a package
@@ -217,9 +214,6 @@
   - title: .npmrc
     url: /configuring-npm/npmrc
     description: The npm config files
-  - title: npm-shrinkwrap.json
-    url: /configuring-npm/npm-shrinkwrap-json
-    description: A publishable lockfile
   - title: package.json
     url: /configuring-npm/package-json
     description: Specifics of npm's package.json handling

docs/lib/content/configuring-npm/package-lock-json.md

@@ -55,9 +55,9 @@ class CI extends ArboristWorkspaceCmd {
     } catch (err) {
       log.verbose('loadVirtual', err.stack)
       const msg =
-        'The `npm ci` command can only install with an existing package-lock.json or\n' +
-        'npm-shrinkwrap.json with lockfileVersion >= 1. Run an install with npm@5 or\n' +
-        'later to generate a package-lock.json file, then try again.'
+        'The `npm ci` command can only install with an existing\n' +
+        'package-lock.json with lockfileVersion >= 1. Run an install with npm@5\n' +
+        'or later to generate a package-lock.json file, then try again.'
       throw this.usageError(msg)
     }
     const virtualInventory = new Map(virtualArb.virtualTree.inventory)
@@ -71,7 +71,7 @@ class CI extends ArboristWorkspaceCmd {
     const errors = validateLockfile(virtualInventory, arb.idealTree.inventory)
     if (errors.length) {
       throw this.usageError(
-        '`npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. ' +
+        '`npm ci` can only install packages when your package.json and package-lock.json are in sync. ' +
         'Please update your lock file with `npm install` before continuing.\n\n' +
         errors.join('\n')
       )

docs/lib/content/nav.yml

@@ -72,7 +72,7 @@ class Query extends BaseCommand {
       } catch (err) {
         log.verbose('loadVirtual', err.stack)
         throw this.usageError(
-          'A package lock or shrinkwrap file is required in package-lock-only mode'
+          'A package-lock.json file is required in package-lock-only mode'
         )
       }
     } else {
@@ -98,7 +98,7 @@ class Query extends BaseCommand {
       } catch (err) {
         log.verbose('loadVirtual', err.stack)
         throw this.usageError(
-          'A package lock or shrinkwrap file is required in package-lock-only mode'
+          'A package-lock.json file is required in package-lock-only mode'
         )
       }
     } else {

lib/commands/ci.js

@@ -39,7 +39,7 @@ class SBOM extends BaseCommand {
     const arb = new Arborist(opts)
 
     const tree = packageLockOnly ? await arb.loadVirtual(opts).catch(() => {
-      throw this.usageError('A package lock or shrinkwrap file is required in package-lock-only mode')
+      throw this.usageError('A package-lock.json file is required in package-lock-only mode')
     }) : await arb.loadActual(opts)
 
     // Collect the list of selected workspaces in the project