Yes, you should use npm shrinkwrap. It baffles me that automatically update your dependencies is considering the right thing to do.<p>Practically that means that you can push a semicolon fix, your CI server will fetch a different (newer) version of a dependency and break something completely unrelated.