# [Node] Package Manager

# npm: Node Package Manager

The popular package managers used in Node.js are **npm** and **yarn**.

## Package.json

The `package.json` file is used **to manage the versions of installed packages**.

Even when using the same package, different functionalities may be available in different versions, so the `package.json` file is necessary when installing a specific version.

In addition to package management, `package.json` can also **record various metadata** such as project name, author, and license information.

Both npm and yarn refer to the same `package.json` file.

## Package-lock.json

The `package-lock.json` file **contains packages in** `package.json` **file and** `node_modules` **directory and their versions and dependencies**.

When installing, modifying, or deleting packages with npm, the dependencies of the packages are recorded in the `package-lock.json` file.

The recorded packages in `package-lock.json` **include exact versions**, allowing for precise management of package versions in the project.

## node\_modules

The `node_modules` directory is where the module files installed via the `npm install` command, based on the contents of the `package.json` file, are collected.

The modules specified in the `package.json` file, as well as their dependencies, are installed together in this directory.

Since the files installed in this folder are specific to your environment, **it should not be included when sharing or distributing your code to other locations**.

By using `npm install` command, we can simply install the packages of other's projects or share our own projects with others.

## devDependencies

If you want to install **modules that are only needed during the development stage**, they will be included in this directory.

You can add them using the `npm install -D <module-name>` command.

### dependencies, devDependencies, and peerDependencies

* **dependencies**
    
    * It specifies the name and version of the packages
        
    * when using `npm install`, if the packages do not exist on `node_modules`, those are installed
        
* **devDependencies**
    
    * It specifies the name and version of packages only for the development or builds environment (configuration and setup used for building or compiling JavaScript code into a production-ready format), not for the code execution
        
    * when using `npm install`, if the packages do not exist on `node_modules`, those are installed
        
* **peerDependencies**
    
    * It specifies the name and version of **compatible packages**.
        
        * It is recommended to specify versions in a lenient manner, **indicating the expected compatibility of the package's versions**. For example, if a package follows Semantic Versioning ([semver](https://docs.npmjs.com/cli/v6/using-npm/semver)), it is generally safe to assume that the behavior is guaranteed as long as the major version does not change. So, using `^1.0` to include all minor versions is preferable.
            
        * On the other hand, if a package's functionality or interface can change with just a minor version change, **it should not be specified too leniently as shown in the example above**.
            
    * Even if a package specified in the `peerDependencies` is not present in the `node_modules` directory, it won't be installed when running `npm install`.
        
        * Instead, **a warning message will be displayed** indicating that the package from `peerDependencies` could not be found in the `node_modules` directory. (Introduced in npm v3 and later)
            
        * When encountering this warning message, **you need to manually install the compatible version of the package**.
            
    * **It allows frameworks or developers to optionally use different versions of packages, making it important to consider when writing packages**.
        

## In Practice

1. `npm init` &gt; to create a Package.json file
    
    1. `npm init -y` does not ask for customization options, just set as default
        
2. `npm install <package-name>`
    

---

# yarn: Yet Another Resource Negotiator

yarn is a package manager just like npm. It was developed by Facebook and is now open-source. The intention behind developing yarn(at that time) was to fix performance and security concerns with npm.

To install: `npm install yarn --global`

While npm generates a 'package-lock.json' file, yarn generates a 'yarn.lock' file. Yarn lock files help in easy merge. The merges are predictable as well, because of the design of the lock file.

[More differences between npm vs. yarn](https://www.geeksforgeeks.org/difference-between-npm-and-yarn/)