What package manager should we use for all projects?

[queengooborg]

Throughout the majority of MDN's repositories, Yarn (Classic) is used for package management. However some repositories (namely browser-compat-data) use NPM. This inconsistency can be slightly jarring for contributors, as they'd have to use (slightly, but still) different commands between repositories governed by the same organization. I think it would be great for us to decide which package manager we should consistently use across the projects.

Here are some pros and cons to some package managers:

• NPM ← This is the voted answer. Work is underway to migrate.
  • Pros
    • Bundled with NodeJS, no separate install needed
    • Performs well (on par with Yarn Classic)
    • The most popular, so should be easy for contributors to pick up
  • Cons
    • Paired with specific NodeJS versions, cannot update independently
    • A lot of our projects use Yarn Classic, so transitioning will be a bit rough
    • Annoying trait: you must pass arguments to npm run scripts after --, else npm catches them, which can be very hard to debug
• Yarn v1 (Classic)
  • Pros
    • Easy to install
    • Performs as well or better than NPM
    • Can update independently, leaving lockfile versions compatible with any NodeJS
    • Easy to run scripts, no need for --
  • Cons
    • In "maintenance mode", only security patches and bug fixes
    • The yarn team has hinted at end-of-life approaching soon
    • A separate dependency to install
• Yarn v2+ (Berry)
  • Pros
    • Actively maintained
    • Also easy to install (especially on NodeJS 16.10+)
    • Can update independently
    • A little easier to migrate to, since we're using Yarn Classic mostly already
  • Cons
    • Huge architectural change from Classic that has not been liked by many developers
    • VERY challenging to uninstall to switch back to Classic
    • Doesn't use node_modules by default...hence the first con
• PNPM
  • Don't know enough about this to indicate pros and cons, just know it by name

[caugner]

My personal preference for yarn was based on the following, possibly outdated arguments:

• yarn was much faster than npm
• yarn had a better lock file
• yarn automatically resolved merge conflicts in the lock file
• yarn automatically separated indirect from direct dependencies (e.g. react-scripts requires eslint-config-react-app, which would not be implicitly available in our node_modules)
• yarn had better workspace support

Now most likely these arguments no longer hold, as npm had a lot of time to catch up, and probably did.

Paired with specific NodeJS versions, cannot update independently

This might be a blocker, because we (read: MDN Engineering team) hear that folks want to use the latest LTS version of NodeJS, but at the same time we're currently stuck at NodeJS 14 with mdn/yari, because we're using AWS Lambdas that don't support NodeJS 16 yet (which will no longer be a problem by 2023, because we're migrating to GCP).

@queengooborg Can you tell how significant those compatibility issues with package-lock.json are between NodeJS versions?

If those arguments no longer hold and if there is no blocker, we would probably prefer to switch everything to npm.

(cc @fiji-flo)

[queengooborg]

I can't really say what the future of package-lock files would look like. As it is now, NodeJS v14 with NPM v6 does work with package-lock v2, which is the current version of the package-lock file. v3 and beyond, however, may present a completely new structure, which would essentially force contributors to update or downgrade.

Overall, I've still seen yarn perform better than npm most of the time, though they're pretty much on par with each other. What I'm worried about, though, is that Yarn Classic will potentially reach end-of-life soon (as hinted at on the installation page), meaning that we'll eventually have to switch anyways.

[queengooborg]

I opened up mdn/yari#6271 to give a small example of some of the things we'd need to do to upgrade to Yarn Berry, should we choose that route!

[OnkarRuikar]

after migration to new pm do we have to delete and re clone the repos?

[queengooborg]

@OnkarRuikar Nope! You might want to delete the node_modules folder just in case, but no need to delete the entire repo clone!

[fiji-flo]

I personally am in favor of NPM. Mainly because it's one less dependency to care about. And I think opting for the default is something good if there's no really strong reason not to.

[schalkneethling]

Hey everyone!

Thank you for starting this discussion @queengooborg! I believe we have come to a point where a vote is in order 😄 Please cast your vote for which package manager you would prefer: #108

[uiolee]

I prefer npm, I think it's more popular and easier to use

[caugner]

FWIW We voted to adopt npm, and there is a work-in-progress PR to migrate to yari, but we didn't get to finish that one yet.