Menu
I accidentally ran npm install in a project that uses Yarn and noticed that npm created a package-lock.json file.
I know that Yarn spiked in popularity in part because it used a lockfile to produce more reliable and deterministic dependency installations than npm, which for a while only had a crippled shrinkwrap feature, but now I'm not sure what to make of this npm lockfile business and whether there's anything compelling about continuing to use Yarn.
So in the spirit of a previous Q and A on StackOverflow on yarn vs shrinkwrap, I ask the following:
724
In Yarn, it is called yarn. lock while in npm, it is called package-lock. json. As the name implies, this file locks the dependencies to their stipulated versions during the installation process, after establishing the versioning parameters in the package.
In short: When present in the project, yarn. lock is the main source of information about the current versions of dependencies in a project. Yarn uses that information to check if it needs to update anything – it compares dependency versions currently installed in a project (listed in yarn.
It is highly recommended you commit the generated package lock to source control: this will allow anyone else on your team, your deployments, your CI/continuous integration, and anyone else who runs npm install in your package source to get the exact same dependency tree that you were developing on.
There are two package lock files that can be identified for the majority of the npm ecosystem: Yarn's yarn. lock.
On paper, Yarn and NPM 5 look almost equivalent. They both have deterministic lock files and have almost matched each other in functionality. Some would say that Yarn was the catalyst to get NPM innovating.
However, after experiencing NPM 5 for a month, my team decided to move to Yarn.
NPM technically has a "more deterministic" lock file in that there is a theoretical guarantee that across NPM versions, NPM will produce the exact same node_modules folder. On the other hand, Yarn's exact hoisting/ordering of dependencies depends on the Yarn version and could change across Yarn versions. In general, this has very little impact.
Why use Yarn then? Merging & reliability.
Yarn made the slight determinism trade-off to achieve a much simpler yarn.lock file that is easier to merge. If you are a solo-developer, this probably will not impact you, but if you are on a team with multiple collaborators committing dependency changes, it quickly becomes a huge problem. NPM's package-lock is practically un-mergeable and you end up having to re-generate or struggle. On the other hand, with Yarn, merges are easy and predictable.
See: https://yarnpkg.com/blog/2017/05/31/determinism/
As a side note, we also found Yarn to be more reliable on average.
94
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
