Mimize shrinkwrap files so that they change less in git.

tools/meteor_npm.js

@@ -299,6 +299,7 @@ _.extend(exports, {
   // npm-shrinkwrap.json with keys like "version" and "from") to the canonical
   // version that matches what users put in the `Npm.depends` clause.  ie,
   // either the version or the tarball URL.
+  // If more logic is added here, it should probably go in minimizeModule too.
   _canonicalVersion: function (depObj) {
     var self = this;
     if (self._isGitHubTarball(depObj.from))
@@ -368,14 +369,59 @@ _.extend(exports, {
 
   // `npm shrinkwrap`
   _shrinkwrap: function(dir) {
+    var self = this;
     // We don't use npm.commands.shrinkwrap for two reasons:
     // 1. As far as we could tell there's no way to completely silence the output
     //    (the `silent` flag isn't piped in to the call to npm.commands.ls)
     // 2. In various (non-deterministic?) cases we observed the
     //    npm-shrinkwrap.json file not being updated
-    this._execFileSync(path.join(files.get_dev_bundle(), "bin", "npm"),
+    self._execFileSync(path.join(files.get_dev_bundle(), "bin", "npm"),
                        ["shrinkwrap"],
                        {cwd: dir});
+    self._minimizeShrinkwrap(dir);
+  },
+
+  // The shrinkwrap file format contains a lot of extra data that can change as
+  // you re-run the NPM-update process without actually affecting what is
+  // installed. This step trims everything but the most important bits from the
+  // file, so that the file doesn't change unnecessary.
+  //
+  // This is based on an analysis of install.js in the npm module:
+  //   https://github.com/isaacs/npm/blob/master/lib/install.js
+  // It appears that the only things actually read from a given dependency are
+  // its sub-dependencies and a single version, which is read by the readWrap
+  // function; and furthermore, we can just put all versions in the "version"
+  // field.
+  _minimizeShrinkwrap: function (dir) {
+    var self = this;
+    var topLevel = self._shrinkwrappedDependenciesTree(dir);
+
+    var minimizeModule = function (module) {
+      var minimized = {};
+      if (self._isGitHubTarball(module.from))
+        minimized.from = module.from;
+      else
+        minimized.version = module.version;
+
+      if (module.dependencies) {
+        minimized.dependencies = {};
+        _.each(module.dependencies, function (subModule, name) {
+          minimized.dependencies[name] = minimizeModule(subModule);
+        });
+      }
+      return minimized;
+    };
+
+    var newTopLevelDependencies = {};
+    _.each(topLevel.dependencies, function (module, name) {
+      newTopLevelDependencies[name] = minimizeModule(module);
+    });
+
+    fs.writeFileSync(
+      path.join(dir, 'npm-shrinkwrap.json'),
+      // Matches the formatting done by 'npm shrinkwrap'.
+      JSON.stringify({dependencies: newTopLevelDependencies}, null, 2)
+        + '\n');
   },
 
   _logUpdateDependencies: function(packageName, npmDependencies) {