On a project I have replaced npm with yarn to get the benefits of it, and also enforce our dependencies are locked in via the yarn.lock
.
Now, a developer added a library with npm@4, which only changed the package.json
, and not of course the yarn.lock
.
I would have expected the yarn install
command to crash on the build server, yet yarn has the--to me unexpected behavior--of adding those libraries in their most current version and then updating the yarn.lock
on the remote:
$ yarn install
[1/4] Resolving packages...
[2/4] Fetching packages...
warning [email protected]: The platform "linux" is incompatible with this module.
info "[email protected]" is an optional dependency and failed compatibility check. Excluding it from installation.
[3/4] Linking dependencies...
[4/4] Building fresh packages...
success Saved lockfile.
Done in 5.07s.
This contradicts yarn's purpose, as the build job does not push the yarn.lock
back to the repository nor should it.
I want each developer to be responsible of the version they are checking in.
Hence, is there a way to have yarn install
exit with an error code if the package.json
and yarn.lock
are out of sync?
You want the --frozen-lockfile
parameter:
$ yarn install --frozen-lockfile
yarn install v0.27.5
warning ../package.json: No license field
[1/4] Resolving packages...
error Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.
This was also recently made clear in the docs for yarn install:
yarn install
Install all the dependencies listed within package.json in the local node_modules folder.
The
yarn.lock
file is utilized as follows:
- If yarn.lock is present and is enough to satisfy all the dependencies listed in package.json, the exact versions recorded in yarn.lock are installed, and yarn.lock will be unchanged. Yarn will not check for newer versions.
- If yarn.lock is absent, or is not enough to satisfy all the dependencies listed in package.json (for example, if you manually add a dependency to package.json), Yarn looks for the newest versions available that satisfy the constraints in package.json. The results are written to yarn.lock.
If you want to ensure yarn.lock is not updated, use
--frozen-lockfile.