After performance, the other main reason we moved from npm to yarn was exactly that it completely removed an entire class of bugs we had that were caused by incompatible packages versions installed in various places of the repo.
In exchange of that, yarn will warn if it encounters packages that don’t declare their reps and peerDeps correctly. And there are loads of those. if you want to be safe and remove these warnings, you will have to either ask the package authors to declare their depa correctly, or fix them yourself manually in your yarn YML file.
Ask your team the question: what's the difference between npm update, npm install, npm update --workspaces, npm install --workspaces, and how the outcome differs between npm versions.
Bonus points for knowing in which scenario package-lock.json is taken into account.
If yarn is even worse, my last hope is gone. Please don't take that post too seriously :)
PHP's de facto package manager is Composer and it's very simple and clear in how it works:
Your composer.json states your dependencies and their version constraints.
Your composer.lock (also a json file) states the actual versions that should be installed, based off your composer.json.
"composer install" installs the exact versions from your composer.lock file, "composer update [package]" updates the lock file based on your constraints.
With npm this doesn't seem to be as straight-forward, sometimes I run "npm install" and the package-lock.json ends up changing, I definitely don't consider npm to be safe.
Because that is what I plan to do. Such a pain when some random dependency 50 packages deep is broken or even pulled from npm and so we can't even finish a deployment build until fixed. Especially for older projects.
So I am not sure it is better than npm, however, at least one does not have that split in package managers, which will additionally create friction in or between teams and projects.
I never want the install command to change anything. I want it to install only.
This is intended behaviour, but seems totally counterintuitive to me. I’m with you, I’m used to Composer and NPM just seems inscrutable at times.
For reference, the approximate equivalent to `composer install` is `npm ci`. This will install the exact versions from package.lock without changing it, however it will also blow away your node_modules directory and install from scratch each time.