Yarn 2: Difference between Zero Installs and normal install?

Question

Regarding Zero Installs, the Yarn 2 documentation says:

While not a feature in itself, the term "Zero Install" encompasses a lot of Yarn features tailored around one specific goal - to make your projects as stable and fast as possible by removing the main source of entropy from the equation: Yarn itself. [...]

I read the whole story, but didn't really understand that fully.

What is the difference between Yarn 2 Zero Installs and Yarn 2 normal install?

Answer 1

The difference is that using Yarn normal install, you won't need to commit the node_modules (all your deps), whereas, using Zero-Install you will have to take care of all your dependencies.

This certainly makes your dependency on remote repositories less, however, it requires more responsibility, as said in the docs:

Note that, by design, this setup requires that you trust people modifying your repository. In particular, projects accepting PRs from external users will have to be careful that the PRs affecting the package archives are legit (since it would otherwise be possible to a malicious user to send a PR for a new dependency after having altered its archive content).

After all, zero-install is a great feature. It solves the "I cloned/switched branch and now a dependency is missing" problem, it speeds up CI significantly and it lowers our dependence on our on-prem npm registry.