Not that this is a showstopper, but I have issues with the package-lock.json file where the `resolved` field (the package's registry URL) constantly flip flops between http and https protocols, depending on which machine I'm on (home, work, or docker container), whenever I run `npm install`. Sounds not so bad, but it becomes a mess in git, and causes any docker build caches to become invalidated.

Recently bumped into https://npm.community/t/packages-with-peerdependencies-are-i... The attitude towards fixing issues ("we won’t be able to fix until we get through an upcoming tree builder rewrite.", yeah right...) is making me want to check out alternatives

One thing that comes to mind is the lockfile not actually acting as a lockfile.

Running ‘npm install’ updates the lockfile :/

Then there was the issue where it didn’t respect git commit hashes that were added to the lockfile, just taking whatever the latest commit was.

We switched around June last year to yarn because git URL dependencies on branches was broken in npm. It would choose incorrect commit ids inexplicably. Beyond that dependency upgrade time is faster.

Just moved to Yarn this weekend strictly because npm link (used to link to a local version of a package) doesn't work the way I want it to.

Everytime I install a new package my previous `npm link` references break in the node_modules folder. `yarn link` keeps these reference. Just as I expect.