mozilla/fxa-auth-server — pull request #603 by dannycoates (2014-03-01 05:09:03+00:00)
Title: switch from lockdown to shrinkwrap

Now that package versions in npm are more stable (http://blog.npmjs.org/post/77758351673/no-more-npm-publish-f) I'd like to propose switching from lockdown to the built-in shrinkwrap.

Advantages:
* built-in, well doc'd, maintained
* faster install runs

Disadvantages:
* less paranoid
* checks version numbers not hash of contents
* relies more heavily on registry.npmjs.org being secure
* but shasum checking is on npm's todo list (https://github.com/npm/npmjs.org/issues/148#issuecomment-35143569)

I think using shrinkwrap simplifies this task *very slightly* and I feel ok with the disadvantages.