Node package managers (npm, yarn, pnpm) - All you need to know

A week ago, one of my friends told me he had joined a new front-end project and needed to install dependencies. However, instead of npm, his manager told him to use yarn. In the project folder, he saw a pnpm-lock.yaml file. He asked me what these are and what I should do.

So I thought this might be a problem for many others, and that's why I decided to talk about this topic in this blog in a simple but in-depth way, OK let's start from the beginning.

What is Nodejs?

Node.js is an open-source, cross-platform runtime environment for executing JavaScript outside of a web browser. It's built on the V8 JavaScript engine, developed by Google for the Chrome browser, which compiles JavaScript into native machine code for efficient execution. Node.js uses an event-driven, non-blocking I/O model that makes it particularly well-suited for building scalable network applications, such as web servers, real-time communication systems, and collaborative tools. Its single-threaded event loop can handle numerous simultaneous connections, which provides high throughput and excellent responsiveness.

Node.js also popularized the use of JavaScript on the server, enabling developers to use a single programming language throughout their entire stack. This has streamlined web development processes, reducing context switching and making it easier to transfer code between the client and server. Node.js's module system, based on the CommonJS specification, allows developers to encapsulate code into reusable packages, which can be shared and updated independently. This modularity is key to managing the complexity of large systems and contributes to the rich ecosystem of third-party modules available through npm, Node.js's package manager.

npm (Node Package Manager)

npm is the default package manager for Node.js and the world’s largest software registry. It was introduced in 2010 and quickly became the cornerstone of the Node.js ecosystem. npm facilitates the installation, updating, and management of Node.js packages, which are modules of JavaScript code that can be reused across projects. The npm registry hosts hundreds of thousands of packages, making a vast array of solutions readily available to developers. npm uses a package.json file to track project dependencies and their versions, ensuring consistency and compatibility.

Features and Advantages of npm

npm automates the process of installing, updating, and managing dependencies, which helps to avoid "dependency hell." It supports semantic versioning (semver) that automatically handles patch and minor updates without breaking the existing code, thus maintaining stability across projects. npm also provides the capability to run scripts and commands defined in package.json, which can automate common tasks such as testing, building, and deployment.

Yarn

Introduced by Facebook in 2016, Yarn emerged as an alternative to npm with the promise of faster, more secure, and more reliable dependency management. Yarn provides deterministic installations by using a yarn.lock file, which precisely records the versions of all installed packages and their dependencies. This ensures that the same dependencies are installed in the same way on every machine, eliminating discrepancies in development environments that might lead to bugs.

Improvements Brought by Yarn

Yarn improves upon npm’s performance by parallelizing operations where possible and caching downloaded packages locally. This means that once a package has been downloaded, it doesn’t need to be downloaded again for other projects using the same package, speeding up subsequent installations. Yarn also checksums all packages to ensure their integrity before executing code, enhancing security.

pnpm

pnpm is another alternative to npm that focuses on performance and efficiency. Introduced in 2016, pnpm uses a unique node_modules approach that employs symlinks to save disk space and significantly reduce the amount of data transferred during installations. Unlike npm and Yarn, pnpm creates a single copy of a module on a disk and then creates a symbolic link to it in the node_modules directory where it’s needed. (I will explain pnpm structure and its algorithms in separate blog)

Key Features of pnpm

pnpm’s strictness in linking packages only if they are explicitly declared in the project’s package.json helps in avoiding accidental usage of transitive dependencies (dependencies of dependencies), thus promoting better practices in dependency management. This also results in a cleaner and more efficient module resolution, reducing potential confusion and conflicts among versions of packages.

npm vs. Yarn vs. pnpm

While npm and Yarn share a similar approach to managing packages, pnpm differs significantly in its strategy by using symlinks to manage node_modules. npm is generally easier to integrate into projects due to its status as the default package manager for Node.js. Yarn’s focus on performance and security makes it particularly suited for large-scale applications or those with stringent reliability requirements. pnpm is often favored in environments where disk space and bandwidth are critical considerations.

Evolution and Current Trends

The evolution of these package managers reflects ongoing efforts to address the complexities of managing dependencies in modern web development. Continuous improvements are being made to enhance security features, reduce overheads, and ensure compatibility with the burgeoning array of tools and frameworks in the JavaScript ecosystem.

For the last section, I want to explain the purpose of lock files in package managers:

Lock Files in Package Managers

Lock files are a crucial component in modern package management, providing a snapshot of all dependencies installed at a given time. This snapshot includes the exact versions and configurations of the packages used in a project. npm uses package-lock.json while Yarn utilizes yarn.lock and pnpm uses pnpm-lock.yaml to maintain these details. These lock files are automatically generated when dependencies are installed and are crucial for ensuring that installations are consistent across different environments, be it development, testing, or production.

Purpose and Benefits of Lock Files

The primary purpose of lock files is to record the exact version of each package and its dependencies as they were installed. This ensures that subsequent installations, regardless of when or where they occur, produce the same structure in node_modules by using the exact versions listed in the lock file. This deterministic behavior is vital for addressing issues related to dependency drift, where different team members or deployment environments might otherwise use slightly different versions of packages, potentially leading to bugs or inconsistencies that are hard to trace.

Lock Files and Dependency Management

Lock files play a significant role in continuous integration and deployment pipelines. By committing lock files into version control systems, teams can ensure that every member and every deployment environment uses the exact same set of dependencies. This not only reduces "works on my machine" problems but also enhances security by ensuring that only audited and approved versions of packages are used in production. Furthermore, lock files allow developers to review changes in dependencies via version control systems, adding an additional layer of oversight before changes are merged into production codebases.

And, in the end hope you enjoy this blog and learn new things about Nodejs and its package management ecosystem.