I have a subdependency that is breaking on node 6.2.0. It is using an old version of subsubdependency.
Setting my package.json to point to the updated dependency has no bearing on what dependency the npm install xxx uses.
It seems I have to fork every dependency in github, point their package.json's at the new commits and try npm install again, which seems like a recursive nightmare of a user experience. what do?
You can use the npm shrinkwrap command, this will create an npm-shrinkwrap.json file and within that you can modify which version a dependency's dependencies should use when running npm install.
Also, before you run npm shrinkwrap you must install all your dependencies otherwise you'll end up with an empty npm-shrinkwrap.json file.
This blog post talks about how it works and here are the docs for npm shrinkwrap.
Its worth noting that by default npm shrinkwrap won't include any devDependencies so if your problematic package was installed using --save-dev you need to explicitly include those packages
npm shrinkwrap --dev
