gistfile1.txt

imap@0.2.4 ./node_modules/imap 
graceful-fs@1.0.1 ./node_modules/graceful-fs 
flickr-js@0.0.1 ./node_modules/flickr-js 
gdata-js@0.1.1 ./node_modules/gdata-js 
mime@1.2.3 ./node_modules/mime 
colors@0.5.0 ./node_modules/colors 
underscore@1.1.7 ./node_modules/underscore 
async@0.1.9 ./node_modules/async 
eyes@0.1.6 ./node_modules/eyes 
api-easy@0.2.3 ./node_modules/api-easy 
request@2.1.1 ./node_modules/request 
wrench@1.1.0 ./node_modules/wrench 
node-fs@0.1.0 ./node_modules/node-fs 
readabilitySAX@0.2.2 ./node_modules/readabilitySAX 
xmlbuilder@0.1.2 ./node_modules/xmlbuilder 
hashish@0.0.4 ./node_modules/hashish 
wordwrap@0.0.2 ./node_modules/wordwrap 
timespan@2.0.1 ./node_modules/timespan 
mkdirp@0.0.7 ./node_modules/mkdirp 
htmlparser2@1.0.0 ./node_modules/htmlparser2 
commander@0.1.0 ./node_modules/commander 
sax@0.2.3 ./node_modules/sax 
pkginfo@0.2.2 ./node_modules/pkginfo 
qs@0.3.1 ./node_modules/qs 
node-fakeweb@0.0.5 ./node_modules/node-fakeweb 
xml2js@0.1.10 ./node_modules/xml2js 
ini@1.0.1 ./node_modules/ini 
cliff@0.1.5 ./node_modules/cliff 
portfinder@0.2.0 ./node_modules/portfinder 
optimist@0.2.6 ./node_modules/optimist 
lastfm@0.7.0 ./node_modules/lastfm 
dropbox@0.3.3 ./node_modules/dropbox 
stack-trace@0.0.5 ./node_modules/stack-trace 
traverse@0.5.1 ./node_modules/traverse 
oauth@0.9.5 ./node_modules/oauth 
winston@0.5.2 ./node_modules/winston 
nconf@0.4.3 ./node_modules/nconf 
connect@1.7.0 ./node_modules/connect 
semver@1.0.10 ./node_modules/semver 
express@2.4.3 ./node_modules/express 
http-proxy@0.7.2 ./node_modules/http-proxy 
forever@0.6.7 ./node_modules/forever 
ejs@0.4.3 ./node_modules/ejs 
knox@0.0.9 ./node_modules/knox 
vows@0.5.11 ./node_modules/vows 
asyncjs@0.0.5 ./node_modules/asyncjs 
mongodb@0.9.6-15 ./node_modules/mongodb 
uglify-js@1.1.1 ./node_modules/uglify-js 
github@0.0.6 ./node_modules/github 
npm@1.0.106 ./node_modules/npm 
daemon@0.3.0 ./node_modules/daemon 
facebook-js@1.0.0 ./node_modules/facebook-js 
└── request@1.9.5
airbrake@0.2.2 ./node_modules/airbrake 
└── request@1.9.8
jade@0.15.4 ./node_modules/jade 
└── mkdirp@0.0.6
clucene@0.2.3 ./node_modules/clucene 
nodemailer@0.2.3 ./node_modules/nodemailer 
└── mimelib-noiconv@0.1.5
socket.io-client@0.8.4 ./node_modules/socket.io-client 
├── xmlhttprequest@1.2.2
├── websocket-client@1.0.0
└── uglify-js@1.0.6
loggly@0.3.8 ./node_modules/loggly 
└── request@1.9.9
socket.io@0.8.5 ./node_modules/socket.io 
├── policyfile@0.0.4
├── redis@0.6.6
└── socket.io-client@0.8.5

Obviously we've gotten a bit lazy about keeping our dependencies updated, but the only time we've seen version conflicts is when 2 packages require conflicting dependencies (that's the case with those request modules that are added.)  Our express always gets connect 1.7.0, because we specified connect 1.7.0 at the top level.  For what it's worth, I certainly agree with checking in submodules, and the only reason we did this is because we didn't know about npm rebuild.