Think carefully about how to consider npm shrinkwrap

I checked the David page for my package imgurgitate https://david-dm.org/hickford/imgurgitate . All the dependencies are status green. This surprised me, because I know if you install the package, you get some old versions of dependencies (underscore is now at 1.6.0 for example)

```
npm install imgurgitate

imgurgitate@0.1.0 node_modules\imgurgitate
├── underscore@1.4.4
├── wrench@1.4.4
├── optimist@0.3.5 (wordwrap@0.0.2)
├── iced-coffee-script@1.4.0-c
├── http-get@0.5.9 (buffer-concat@0.0.1, semver@1.1.4)
└── request@2.16.6 (aws-sign@0.2.0, forever-agent@0.2.0, tunnel-agent@0.2.0, oauth-sign@0.2.0, json-stringify-safe@3.0.0, cookie-jar@0.2.0, mime@1.2.9, node-uuid@1.4.0, qs@0.5.5, hawk@0.10.2, form-data@0.0.7)
```

Is David wrong?

What's really going on is the package has both a `package.json` and a `npm-shrinkwrapped.json`. Read https://www.npmjs.org/doc/cli/npm-shrinkwrap.html and http://blog.nodejs.org/2012/02/27/managing-node-js-dependencies-with-shrinkwrap/ for explanations

The package.json says "I don't require old software", but the shrinkwrap says "these are the versions of dependencies I was developed and tested against and I suggest you use". They happen to be old.

How David should treat that depends on its purpose. Is it always bad to install old software? Or only to mandate it? I don't know. What do you think?