npm VS yarn

The fact that JSON doesn't support comments is so annoying, and I always thought that Douglas Crockford's rationale for this basically made no sense ("They can be misused!" - like, so what, nearly anything can be misused. So without support for comments e.g. in package.json files I have to do even worse hacky workaround bullshit like "__some_field_comment": "this is my comment"). There is of course jsonc and JSON5 but the fact that it's not supported everywhere means 10 years later we still can't write comments in package.json (there is https://github.com/npm/npm/issues/4482 and about a million related issues).

Things like the sparkline charts on npmjs (e.g. https://www.npmjs.com/package/npm ) are interactive SVGs. I think they're pretty common for data visualizations of all kinds

I actually did a POC 7 years ago about this - https://github.com/tanepiper/steal-ur-stuff

It was reported to npm at the time, but they chose to ignore it - https://github.com/npm/npm/issues/17724

Every time this pops up, I'm reminded of the day that the NPM registry started returning 418 responses.

I remember being at a training course that day and my manager asking me what we could do to fix it because our CI was failing to pull dependencies from NPM.

Trying to explain that NPM was returning a status code intended as an April Fools joke and which was never meant to see the light of production was quite difficult

https://github.com/npm/npm/issues/20791

I should really get around to how I discovered this 6 years ago and still nothing done about it

Whenever something like this comes up I usually have to tap the sign (and the original report)

NPM is not "Node Package Manager". https://www.npmjs.com/package/npm

> which can be overriden with env setting

Support for this is not great. Lots of packages still don't support this properly. My experience matches the 2015 comment https://github.com/npm/npm/issues/775#issuecomment-71294085

> Not sure why "symlinks" would be involved.

If you make your node_modules a symlink, multiple packages will fail. Even if you're not interested in doing that, others are.

> What NPM does is leaps and bounds ahead

Unless you change your node / gyp version. It doesn't really have a concept of runtime version. You can restrict it, but not have two concurrent versions if they conflict.

[email protected] was released in May 2017 and it seems to address many of the issues that Yarn aims to solve. Do keep an eye on it!

I think it's had been supposed to do that since forever. Apart from some bug in npm 5.3. Are you sure your package-lock versions actually conform to the semver ranges in your package.json?

instead. Please refer tothis issue for guidance. Following the instructions in this issue will ensure the correct installation of Yarn.

As an alternative, you can use the Yarn CLI command:

The PR for Auto detect and merge lockfile conflicts provides insight into the latest implementation in /src/lockfile/parse.js.

this this maybe https://github.com/yarnpkg/yarn/issues/8331

Yarn, but you can use npm or pnpm as alternatives to yarn if you prefer.

Yarn definitely shot themselves in the foot badly. PnP identified real problems & came up with a solution, but pnpm is doing a similar set of tricks but in a Node-ecosystem-compatible way, with next to no compatibility issues (versus package maintainers having to each individually support Yarn V2 PnP). Yarn V2 seemingly thought they could get the entire npm package world to switch to yarn, saw their growth & saw the thought-leaders & decided their winning was a fait-accompli.

And they didn't really execute very well... v2 landed, there was controversy, and there's been so little visible or exciting good news about it. It over-played Yarns so hand they renamed Yarn v2 as Berry, just to re-gather the troops & make a staging point forward. But it's still an incredibly hard pill to swallow, and the "yarn (berry) is great, the ecosystem needs to change" attitude seemingly isn't gaining any traction and it's hard to tell where Yarn could go.

In Yarn v3[1], they've introduced a modular "linker" system for how to install packages, that seemingly might get them able to experiment around/play around a little more & be less constrained than the hard-path they'd crusaded for.

One thing I will say for Yarn, that makes me unbelievably happy versus npm (announced during the V2[2] announcement):

> Yarn is first and foremost a Node API that can be used programmatically (via @yarnpkg/core)

Npm is the premier tool for open-source javascript, but it itself is one of the least open-source efforts on the planet. I finally started digging around the npm package and it's underlying cacache cache-structure, and it's just infinitely unpleasant to get started with. There's maybe like 3 articles on the whole planet that have any guidance for what npm is inside, how it works, what you can do with it, how you can hack it. Yarn identifying that the package manager itself is something that developers need access to is a huge win & I want to thank them forever for putting that on their bullet list of great Yarn things.

[1] https://dev.to/arcanis/yarn-3-0-performances-esbuild-better-...

[2] "Yarn's Future - v2 and beyond" https://github.com/yarnpkg/yarn/issues/6953

Unfortunately, as I found out, yarn's resolutions property has a long history of not playing well with optionalDependencies: anything placed into resolutions is treated as required and will abruptly fail to install if it is, for example, a platform-specific package appropriate for your deploy environment but not your dev environment or vice versa, as is the case here.

It was July 2021. I started with [email protected] since I’ve been using it for a long time. Yarn was fast, but soon I met several issues with Yarn Workspaces. E.g., not hoisting dependencies correctly, and tons of issues are tagged with “fixed in modern”, which redirects me to the v2 (berry).

Upgrading dependencies: Yarn 1's yarn upgradeonly upgrades direct dependencies of the current workspace. Yarn 2's up ignores the version ranges in your package.json and upgrades for all workspaces. npm's and pnpm'supdate respect your version ranges and upgrade indirect dependencies as well.