> For the complete documentation index, see [llms.txt](https://shoppinpal.gitbook.io/docs-shoppinpal-com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shoppinpal.gitbook.io/docs-shoppinpal-com/3.-the-backend/lockdown.md).

# Lockdown

* Make sure you're in the loopback project directory:

  ```
  $ pwd
  /home/codio/workspace/loopback-zero-to-hero
  ```
* If not, then get in there:

  ```
  $ cd ~/workspace/loopback-zero-to-hero/
  ```
* Its easy to let the flexible versioning notations (`*`, `~` or `^`) in `package.json` fool us into working against different versions of dependencies! Since features and bugs vary across versions, let us make sure to work with precisely defined versions for all dependencies.
* The `package.json` file is lenient and uses the `^` symbol to let you install anything newer than the listed version. For example, the current `package.json` file which was generated by `slc` and it contains:

  ```
  "loopback": "^2.14.0",
  "loopback-boot": "^2.6.5",
  "loopback-datasource-juggler": "^2.19.0",
  ```

  but if you inspect what was installed (when `npm install` auto ran as part of project setup) you'll see much newer versions:

  ```
  $ npm ls | grep loopback
  ...
  ```
* Now let's freeze the versions so any development or deployments in the future will use these installed versions and nothing else:

  ```
  $ npm shrinkwrap
  ...
  wrote npm-shrinkwrap.json
  ```
* A new file is produced. Examine [npm-shrinkwrap.json](https://github.com/shoppinpal/docs-shoppinpal-com/tree/8cdd099563d11c1fe1df4d584b504337850c59eb/loopback/open_file%20loopback-zero-to-hero/npm-shrinkwrap.json;) and you will see a much more explicit file that tracks the versions of every dependency and sub-dependency etc. As long as you leave this file in your project and preferably check it into your source control repository, you can expect consistent behavior across developers and deployments. From now on whenever `npm install` is run, it will ignore the wishy-washy `package.json` and instead pay attention to `npm-shrinkwrap.json`
* Good deal! onwards and upwards...