shouldn't "npm-shrinkwrap.json" be authoritative also for that ?