rfcs
yarn
rfcs | yarn | |
---|---|---|
35 | 34 | |
718 | 41,324 | |
0.6% | 0.1% | |
5.7 | 0.0 | |
10 days ago | 28 days ago | |
JavaScript | JavaScript | |
GNU General Public License v3.0 or later | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
rfcs
-
Yarn 4.0
npm workspaces plus Wireit works far better than Lerna, in my experience.
https://github.com/google/wireit
Wireit's ability to specify actual script dependencies, do caching (and on Github actions), and it's long-running service script support make it much more useful and comprehensive than Lerna.
I agree that this should be built into npm. There's an RRFC for it here: https://github.com/npm/rfcs/issues/706
-
NPM vs Yarn?
It's coming https://github.com/npm/rfcs/blob/main/accepted/0042-isolated-mode.md
-
How do you know that the .exe or .apk file for an open source software on github is actually compiled from the viewable source code?
This just got accepted as a proposal in NPM: https://github.com/npm/rfcs/pull/626
-
Why aren't Node.js package managers interoperable?
npm also plans to support pnpm-style node_modules
-
Axios shipped a buggy version and it broke many productions apps. Let this be a lesson to pin your dependencies!
(I usually end up removing npm ci from CI/CD since I think it is way too slow and want to cache node_modules from previous builds; I'm waiting for https://github.com/npm/rfcs/issues/415 to land to make this fail-safe npm install --from-lockfile. Yarn does support this already)
- How to run multiple NPM commands simultaneously using concurrently
- [RRFC] Parallel script execution when value is set to an array of text. · Issue #610 · npm/rfcs
- Lerna has gone. Which Monorepo is right for a Node.js BACKEND now?
- NPM introduces a new Dependency Selector Syntax
-
How to respond to growing supply chain security risks?
I started following this problem from the discussion at npm about making install scripts opt-in. But install scripts are not the only threat, there are more ways for malicious actors:
yarn
- Configurar Solana en Linux
-
Set up your own LMQL environment.
instead. Please refer tothis issue for guidance. Following the instructions in this issue will ensure the correct installation of Yarn.
-
What is jQuery?
As an alternative, you can use the Yarn CLI command:
-
Lockfile merge conflicts, how to handle it correctly?
The PR for Auto detect and merge lockfile conflicts provides insight into the latest implementation in /src/lockfile/parse.js.
-
Yarn Install Broken
this this maybe https://github.com/yarnpkg/yarn/issues/8331
-
How I Built an Android Ecommerce App with Medusa
Yarn, but you can use npm or pnpm as alternatives to yarn if you prefer.
-
Benchmarks of JavaScript Package Managers
Yarn definitely shot themselves in the foot badly. PnP identified real problems & came up with a solution, but pnpm is doing a similar set of tricks but in a Node-ecosystem-compatible way, with next to no compatibility issues (versus package maintainers having to each individually support Yarn V2 PnP). Yarn V2 seemingly thought they could get the entire npm package world to switch to yarn, saw their growth & saw the thought-leaders & decided their winning was a fait-accompli.
And they didn't really execute very well... v2 landed, there was controversy, and there's been so little visible or exciting good news about it. It over-played Yarns so hand they renamed Yarn v2 as Berry, just to re-gather the troops & make a staging point forward. But it's still an incredibly hard pill to swallow, and the "yarn (berry) is great, the ecosystem needs to change" attitude seemingly isn't gaining any traction and it's hard to tell where Yarn could go.
In Yarn v3[1], they've introduced a modular "linker" system for how to install packages, that seemingly might get them able to experiment around/play around a little more & be less constrained than the hard-path they'd crusaded for.
One thing I will say for Yarn, that makes me unbelievably happy versus npm (announced during the V2[2] announcement):
> Yarn is first and foremost a Node API that can be used programmatically (via @yarnpkg/core)
Npm is the premier tool for open-source javascript, but it itself is one of the least open-source efforts on the planet. I finally started digging around the npm package and it's underlying cacache cache-structure, and it's just infinitely unpleasant to get started with. There's maybe like 3 articles on the whole planet that have any guidance for what npm is inside, how it works, what you can do with it, how you can hack it. Yarn identifying that the package manager itself is something that developers need access to is a huge win & I want to thank them forever for putting that on their bullet list of great Yarn things.
[1] https://dev.to/arcanis/yarn-3-0-performances-esbuild-better-...
[2] "Yarn's Future - v2 and beyond" https://github.com/yarnpkg/yarn/issues/6953
-
Using TypeScript 4.9 with Next.js 12
Unfortunately, as I found out, yarn's resolutions property has a long history of not playing well with optionalDependencies: anything placed into resolutions is treated as required and will abruptly fail to install if it is, for example, a platform-specific package appropriate for your deploy environment but not your dev environment or vice versa, as is the case here.
-
TypeScript all-in-one: Monorepo with its pains and gains
It was July 2021. I started with [email protected] since I’ve been using it for a long time. Yarn was fast, but soon I met several issues with Yarn Workspaces. E.g., not hoisting dependencies correctly, and tons of issues are tagged with “fixed in modern”, which redirects me to the v2 (berry).
-
Why aren't Node.js package managers interoperable?
Upgrading dependencies: Yarn 1's yarn upgradeonly upgrades direct dependencies of the current workspace. Yarn 2's up ignores the version ranges in your package.json and upgrades for all workspaces. npm's and pnpm'supdate respect your version ranges and upgrade indirect dependencies as well.
What are some alternatives?
vm2 - Advanced vm/sandbox for Node.js
berry - 📦🐈 Active development trunk for Yarn ⚒
pnpm - Fast, disk space efficient package manager
corepack - Zero-runtime-dependency package acting as bridge between Node projects and their package managers
Bower - A package manager for the web
Cargo - The Rust package manager
npm
GHSA-g2q5-5433-rhrf
yarn-deduplicate - Deduplication tool for yarn.lock files
feedback - Public feedback discussions for npm
setup-node - Set up your GitHub Actions workflow with a specific version of node.js