Yeah, definitely prefer this one over all the others. Only thing that bothers me a little bit is the generation of npm-shrinkwrap file since you need to do that from src folder AND not to forget about it 👍

I'd be in for using yarn to automatically generate yarn.lock files instead npm-shrinkwrapping.

https://yarnpkg.com/en/docs/yarn-lock

That'd mean introducing another tool, we'd have to use yarn instead of npm install, not sure how yarn works with npm install scripts... to be honest I don't think yarn is worth the complexity it adds.

I agree with introducing another tool being cumbersome, but it's a tool that's fully compatible with npm and pretty much improvement in every way (especially with speed and security), especially if we need to fiddle around with npm-shrinkwrap which is basically somewhat broken at this point.

For the grunt script the work needed would be basically s/npm install/yarn, plus with enforcing --pure-lockfile we could ensure that right deps would always be installed.

Disclaimer: I have only used yarn after it came out and I am a huge fan 😸 Not saying that we would need to do it right now (or ever), we can punt it into an issue and think about it later too 👍

I think this is the best approach from the three we tried.
If we have problems with shrinkwrap, we can introduce yarn later.
For now merging this 👍