npm: Node Package Manager

The popular package managers used in Node.js are npm and yarn.

Package.json

The package.json file is used to manage the versions of installed packages.

Even when using the same package, different functionalities may be available in different versions, so the package.json file is necessary when installing a specific version.

In addition to package management, package.json can also record various metadata such as project name, author, and license information.

Both npm and yarn refer to the same package.json file.

Package-lock.json

The package-lock.json file contains packages in package.json file and node_modules directory and their versions and dependencies.

When installing, modifying, or deleting packages with npm, the dependencies of the packages are recorded in the package-lock.json file.

The recorded packages in package-lock.json include exact versions, allowing for precise management of package versions in the project.

node_modules

The node_modules directory is where the module files installed via the npm install command, based on the contents of the package.json file, are collected.

The modules specified in the package.json file, as well as their dependencies, are installed together in this directory.

Since the files installed in this folder are specific to your environment, it should not be included when sharing or distributing your code to other locations.

By using npm install command, we can simply install the packages of other's projects or share our own projects with others.

devDependencies

If you want to install modules that are only needed during the development stage, they will be included in this directory.

You can add them using the npm install -D <module-name> command.

dependencies, devDependencies, and peerDependencies

• dependencies

  • It specifies the name and version of the packages

  • when using npm install, if the packages do not exist on node_modules, those are installed

• devDependencies

  • It specifies the name and version of packages only for the development or builds environment (configuration and setup used for building or compiling JavaScript code into a production-ready format), not for the code execution

  • when using npm install, if the packages do not exist on node_modules, those are installed

• peerDependencies

  • It specifies the name and version of compatible packages.

    • It is recommended to specify versions in a lenient manner, indicating the expected compatibility of the package's versions. For example, if a package follows Semantic Versioning (semver), it is generally safe to assume that the behavior is guaranteed as long as the major version does not change. So, using ^1.0 to include all minor versions is preferable.

    • On the other hand, if a package's functionality or interface can change with just a minor version change, it should not be specified too leniently as shown in the example above.

  • Even if a package specified in the peerDependencies is not present in the node_modules directory, it won't be installed when running npm install.

    • Instead, a warning message will be displayed indicating that the package from peerDependencies could not be found in the node_modules directory. (Introduced in npm v3 and later)

    • When encountering this warning message, you need to manually install the compatible version of the package.

  • It allows frameworks or developers to optionally use different versions of packages, making it important to consider when writing packages.

In Practice

1. npm init > to create a Package.json file

   1. npm init -y does not ask for customization options, just set as default

2. npm install <package-name>

---

yarn: Yet Another Resource Negotiator

yarn is a package manager just like npm. It was developed by Facebook and is now open-source. The intention behind developing yarn(at that time) was to fix performance and security concerns with npm.

To install: npm install yarn --global

While npm generates a 'package-lock.json' file, yarn generates a 'yarn.lock' file. Yarn lock files help in easy merge. The merges are predictable as well, because of the design of the lock file.

More differences between npm vs. yarn