update

ossf · Jul 13, 2022 · 5d7a702 · 5d7a702
1 parent 870f53c
commit 5d7a702
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/review/npm.md b/review/npm.md
@@ -327,7 +327,8 @@ unpinned dependencies and update the lockfiles:
       for rapidly and consistently updating all the dependencies. Your users will not be able 
       to update or deduplicate them. If you expect your CLI to be used by other projects and defined
       in their `package.json` or lockfile, do **not** use `npm-shrinkwrap.json` because it will
-      hinder dependency resolution for your consumers.
+      hinder dependency resolution for your consumers: follow the recommendations as if your project
+      was a library.
 
    1. In CI, only run npm commands that treat the lockfile as
       read-only (see [Lockfiles and commands](#lockfiles-and-commands)).