What is the difference between yarn.lock and npm's package-lock?
I accidentally ran npm install in a project that uses Yarn and noticed that npm created a package-lock.json file.
I know that Yarn spiked in popularity in part because it used a lockfile to produce more reliable and deterministic dependency installations than npm, which for a while only had a crippled shrinkwrap feature, but now I'm not sure what to make of this npm lockfile business and whether there's anything compelling about continuing to use Yarn.
So in the spirit of a previous Q and A on StackOverflow on yarn vs shrinkwrap, I ask the following:
- Are there any substantial differences between the two package managers in terms of reliability any more?
- If not, is there any compelling reason to continue using Yarn besides "More emojis. 🐈"?
Answer
On paper, Yarn and NPM 5 look almost equivalent. They both have deterministic lock files and have almost matched each other in functionality. Some would say that Yarn was the catalyst to get NPM innovating.
However, after experiencing NPM 5 for a month, my team decided to move to Yarn.
NPM technically has a "more deterministic" lock file in that there is a theoretical guarantee that across NPM versions, NPM will produce the exact same node_modules folder. On the other hand, Yarn's exact hoisting/ordering of dependencies depends on the Yarn version and could change across Yarn versions. In general, this has very little impact.
Why use Yarn then? Merging & reliability.
Yarn made the slight determinism trade-off to achieve a much simpler yarn.lock file that is easier to merge. If you are a solo-developer, this probably will not impact you, but if you are on a team with multiple collaborators committing dependency changes, it quickly becomes a huge problem. NPM's package-lock is practically un-mergeable and you end up having to re-generate or struggle. On the other hand, with Yarn, merges are easy and predictable.
See: https://yarnpkg.com/blog/2017/05/31/determinism/
As a side note, we also found Yarn to be more reliable on average.